Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About HIeu Phan
09-22-2018
Stats
Member since
11-25-2013
10
Posts
10
Helpful
0
Solutions
04-08-2015
09:26 PM
Hi Minhda, it's not any particular prefix. I just want the outbound traffic to share out instead of just using one single best path. Patrick, all link has the same speed. That was an interesting concept, but it is still a little bit forcing and odd setup. I found a cisco article on this earlier, though I couldnt understand how they can get LB out from what they said. I'll put it up here in the next post.
... View more
04-08-2015
05:48 PM
Here is a quick diagram (i have to change the AS #, sorry guys :) ) and also my BGP config router bgp 4444 bgp router-id 10.26.0.150 bgp log-neighbor-changes network 64.79.131.0 mask 255.255.255.192 network 64.79.151.0 mask 255.255.255.224 network 66.116.101.0 mask 255.255.255.224 network 66.116.119.96 mask 255.255.255.224 neighbor 64.79.159.77 remote-as 23 neighbor 64.79.159.77 soft-reconfiguration inbound neighbor 64.79.159.77 prefix-list BGP_DEFAULT_ONLY in neighbor 64.79.159.77 prefix-list BGP_LOCAL_ONLY out neighbor 64.79.159.89 remote-as 23 neighbor 64.79.159.89 soft-reconfiguration inbound neighbor 64.79.159.89 prefix-list BGP_DEFAULT_ONLY in neighbor 64.79.159.89 prefix-list BGP_LOCAL_ONLY out neighbor 199.189.117.121 remote-as 22 neighbor 199.189.117.121 soft-reconfiguration inbound neighbor 199.189.117.121 prefix-list BGP_DEFAULT_ONLY in neighbor 199.189.117.121 prefix-list BGP_LOCAL_ONLY out maximum-paths 5
... View more
04-08-2015
05:19 PM
Hi everyone, I'm having BGP configured on a pair of 6880-X in VSS, and we are peering with 3 peers and 2 AS. For a while now, I noticed that while our inbound are somewhat LB between 2 peers (on on each AS, i'm not sure why the 2nd peer on the same AS not picking up any traffic), outbound traffic only stick with one peer at a time. I saw a lot of posts online, and in here, states to use LocalPreference to gain Load Balancing. But even when I apply LocalPreference to one peer, that I accomplished was outbound traffic now head out to another peer, but no LB at all. What should I do?
... View more
Labels:
07-18-2014
08:09 PM
hi Reza, thank you for answering my question. But that wasn't what i asked for. I know what is VRF. We are using VRF in our environment. My question is: CAT6880-X management port is a seperate port (not like Nexus where the management port is in a management VRF). That's why I'm confused why do I need to use vrf-also when I apply the access-list to VTY. According to document on CAT6880-X, or SUP2T in general, the management port has its own CPU and Memory, so there is no Management VRF.
... View more
07-18-2014
06:08 PM
hi everyone, Can someone explain to me the usage of VRF-Also? I have a pair of CAT6880-X. I setup SSH and want to lock down access to management to only my management subnet. Since I have a lot of SVI, i don't want people on those VLAN access the management of the switch. I'm using the Management 0 port. Without putting any access-list to vty, any IP can SSH into the switch. Originally, I had the below config ! ip access-list extended management-acl permit tcp 172.16.20.0 0.0.0.255 any eq 22 deny tcp any any eq 22 permit ip any any ! line vty 0 4 access-class management-acl in transport input ssh line vty 5 15 access-class management-acl in transport input ssh ! When i tried to SSH in, i can see that the access-list got hit, but I couldn't SSH into the switch, from 172.16.20.10 Extended IP access list management-acl 10 permit tcp 172.16.20.0 0.0.0.255 any eq 22 (79 matches) 20 deny tcp any any eq 22 (6 matches) 30 permit ip any any Then I saw a Cisco Document regarding vrf-also. so I applied it and it finally worked line vty 0 4 access-class management-acl in vrf-also transport input ssh line vty 5 15 access-class management-acl in vrf-also transport input ssh My question is: I'm not using VRF. I'm basically using the Management port. I do not understand the purpose of vrf-also for my case, and I couldn't understand why it didn't work without "vrf-also". Could you help me explain it?
... View more
Labels:
04-25-2014
01:47 PM
Thank you Jose! I actually create a rule pretty similar to what you stated. Things are working really good now. Thank you for your help
... View more
04-18-2014
12:52 PM
hi everyone, I'm running into an odd situation with DMZ config on 9.0(3). I manage to get it to work with an ANY statement, but i hate that. So below is how my current traffic is INSIDE--------------------------> DMZ --------nat-------->OUTSIDE 192.168.3.4/24 192.168.1.55 x.x.x.55 Right now 192.168.1.55 (DMZ) can reach both inside and outside perfectly fine. However, because i use an ANY statement, the host in DMZ is actually able to reach the entire INSIDE subnet. I don't want that. I just want it to be able to reach 192.168.3.4 only. Below is my config (i remove lines that are unneccessary) ! interface Port-channel1.102 vlan 102 nameif outside security-level 0 ip address 66.111.20.252 255.255.255.0 ! ! interface Port-channel3.7 vlan 7 nameif dmz security-level 50 ip address 192.168.1.251 255.255.255.0 ! interface Port-channel5 nameif inside security-level 100 ip address 192.168.3.250 255.255.255.0 ! object network Internal-LAN2_Network subnet 192.168.3.0 255.255.255.0 object network Hieu-DMZ-Laptop host 192.168.1.55 object network DMZ_Network subnet 192.168.1.0 255.255.255.0 object network Hieu-WAN-Laptop host 66.111.20.55 object network CORE-Management-VLAN2 host 192.168.3.4 object network WAN_Network subnet 66.111.20.0 255.255.255.0 ! access-list dmz_access_in extended permit ip object Hieu-DMZ-Laptop object CORE-Management-VLAN2 access-list dmz_access_in extended permit ip object Hieu-DMZ-Laptop any access-list outside_access_in extended permit ip any object Hieu-DMZ-Laptop ! ! object network Internal-LAN2_Network nat (inside,dmz) static Internal-LAN2_Network object network Hieu-DMZ-Laptop nat (dmz,outside) static Hieu-WAN-Laptop ! nat (any,outside) after-auto source dynamic any interface description INSIDE_OUTBOUND_NAT ! access-group outside_access_in in interface outside access-group dmz_access_in in interface dmz ! route outside 0.0.0.0 0.0.0.0 65.115.229.1 1 !
... View more
Labels:
02-18-2014
08:47 PM
Hi everyone, I'm working on building a Policing policy on our 6509-VSS (soon to be 6880-X VSS) because we are hosting a lot of customers environment and we want to throttle their bandwidth down, based on customers' SVI Below is just a "paper" config that I came up with while reading the Release Note for iOS 15-1SY on SUP2T. Can you let me know if this will work? Unfortunately for us, we do not have a test environment to test this config, so I have to ensure that this config is OK before starting to apply it. Also, for a Service Provider type, would you recommend Policing or Shaping? Router(config)# platform qos police distributed strict Router(config)#class-map Class_25Mbps Router(config-cmap)#match vlan 2245 !- assuming this is customer A Router(config-cmap)#match vlan 2246 !- this is customer B, who bought the same bandwidth Router(config-cmap)#end Router(config)#policy-map Policy_25Mbps Router(config-pmap)#class Class_25Mbps Router(config-pmap-c)#police aggregate Aggr_25Mbps Router(config-pmap-c)# police 25000000 pir 35000000 conform-action transmit exceed-action drop Router(config)#interface vlan 10 Router(config-if)#service-policy input Policy_25Mbps Router(config-if)#service-policy output Policy_25Mbps Router(config-if)#end
... View more
- Tags:
- 6509
Labels:
11-26-2013
12:38 AM
Thanks Jon. I will give this a try tomorrow's morning. This same server also need an entire subnet of VDI desktops. How would my static for that part will look like? static (inside,dmz) 192.168.26.0 192.168.26.0 netmask 255.255.255.0 ?
... View more
11-25-2013
05:12 PM
hi everyone, I just inherit an ASA from the previous System Admin and I need to configure it to allow a server sitting on DMZ to communicate with 2 (failover) servers on INSIDE zone on various UPD and TCP port. DMZ host : 192.168.3.202 INSIDE host 1: 192.168.2.122 INSIDE host 2: 192.168.2.123 I couldn't get the DMZ host to talk to the INSIDE host at all. Can you help me look at my configuration? For testing, i even added the 3 lines that I high-light in Orange to see if the communication go through or not. !--------------------------------------------------------------------------- ! DMZ_Access_IN ACL ! --------------------------------------------------------------------------- access-list dmz_access_in extended permit tcp host 192.168.3.202 host 192.168.2.122 eq 8009 access-list dmz_access_in extended permit tcp host 192.168.3.202 host 192.168.2.122 eq 4001 access-list dmz_access_in extended permit udp host 192.168.3.202 host 192.168.2.122 eq isakmp access-list dmz_access_in extended permit udp host 192.168.3.202 host 192.168.2.122 eq 4500 access-list dmz_access_in extended permit tcp host 192.168.3.202 host 192.168.2.123 eq 8009 access-list dmz_access_in extended permit tcp host 192.168.3.202 host 192.168.2.123 eq 4001 access-list dmz_access_in extended permit udp host 192.168.3.202 host 192.168.2.123 eq isakmp access-list dmz_access_in extended permit udp host 192.168.3.202 host 192.168.2.123 eq 4500 access-list dmz_access_in extended permit ip host 192.168.3.202 host 192.168.2.122 access-list dmz_access_in extended permit ip any host 192.168.2.122 access-list dmz_access_in extended permit icmp any host 192.168.2.1 access-list dmz_access_in extended deny ip any 192.168.2.0 255.255.255.0 access-list dmz_access_in extended permit ip any any global (dmz) 1 interface nat (dmz) 1 192.168.3.0 255.255.255.0 static (dmz,outside) x.x.x.x 192.168.3.202 netmask 255.255.255.255 access-group dmz_access_in in interface dmz
... View more
Labels:
04-08-2015
Hi Minhda,it's not any particular prefix. I just want the outbound
traffic to share out instead of j...
04-08-2015
Here is a quick diagram (i have to change the AS #, sorry guys :) )and
also my BGP config router bgp...
04-08-2015
Hi everyone,I'm having BGP configured on a pair of 6880-X in VSS, and we
are peering with 3 peers an...
07-18-2014
hi Reza, thank you for answering my question. But that wasn't what i
asked for. I know what is VRF. ...
07-18-2014
hi everyone,Can someone explain to me the usage of VRF-Also? I have a
pair of CAT6880-X. I setup SSH...
04-25-2014
Thank you Jose!I actually create a rule pretty similar to what you
stated.Things are working really ...
04-18-2014
hi everyone,I'm running into an odd situation with DMZ config on 9.0(3).
I manage to get it to work ...
02-18-2014
Hi everyone,I'm working on building a Policing policy on our 6509-VSS
(soon to be 6880-X VSS) becaus...
11-26-2013
Thanks Jon.I will give this a try tomorrow's morning. This same server
also need an entire subnet of...
Public Statistics
| Date Registered | 11-25-2013 05:04 PM |
| Date Last Visited | 09-22-2018 11:11 PM |
| Total Messages Posted | 10 |
| Total Helpful Votes Received | 10 |
