From the configuration you shared, aaa authentication login default group tacacs+ local, I saw that you are using the default list which is applied to all login connections (such as vty, console, aux). As a result, login from console is also authenticated using tacacs server followed by local. If you want to read more, please look at the following page:- https://www.cisco.com/c/en/us/support/docs/security-vpn/terminal-access-controller-access-control-system-tacacs-/10384-security.html#login_auth HTH, Meheretab
... View more
It looks like the device could reach to the tacacs server, but user authentication failed. As a result, it could not failover to local database. It could be due to either mis-configuration of tacacs on the switch, or failed authentication. You can attempt login on console port using local username/password. If it is not working, I would login to the upstream switch/router: block traffic from the switch to the tacacs server using ACL (be careful when you write the ACL), login using the local username/password, and double check the tacacs configuration on the switch. HTH, Meheretab
... View more
Hi, Yes, you can configure the same IP address of a physical interface as Virtual IP address in VRRP configuration, which is not the case for HSRP. If a VRRP router owns the IP address of the virtual router and the IP address of the physical interface, this router will function as a virtual router master. The owner of the IP address is the master; and when the master fails, the backup router (or one of the backup routers) will take over the master role. When the original virtual master recovers, it will become master. Preemption is enabled by default. You can disable it using no vrrp preempt. Look at the following to learn more: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipapp_fhrp/configuration/xe-3s/fhp-xe-3s-book/fhp-vrrp.html I personally prefer to configure different IP address as the Virtual IP address (b/c I configure HSRP most of the time). HTH, Meheretab
... View more
1) What output you get when you run the following commands after sending interesting traffic: show crypto isakmp sa, sh crypto ipsec sa? Run as follows: ping 192.168.1.1 !(Intersting traffic) show crypto isakmp sa show crypto ipsec sa 2) Is the other side configured correctly, for both Phase 1 and Phase 2 as well as interesting traffic (192.168.1.0/24 -> 192.168.2.0/24)? HTH, Meheretab
... View more
Yes, similar route-map configuration can be used. When you redistribute Static to EIGRP replace the subnets keyword with metric and metric values. Example: router eigrp 123 redistribute static STATIC-to-EIGRP metric 10000 100 255 1 1500 ! HTH, Meheretab
... View more
Hi, I have questions on your setup: 1) Where is the ASA? Is it being replaced with Checkpoint? If yes, is " no passive-interface GigabitEthernet0/0/2.200" command still needed on OSPF connecting to Checkpoint? Do you need to replace it with different interface? 2) You mentioned that you are getting routes flapping between the two VRFs; which two VRFs? HTH, Meheretab
... View more
Hi Dean, I have a couple of questions:- 1) Is your VPN DMVPN? If yes, do you consider configuring multiple hubs on each spoke? 2) Do you have your own public IP address block? If yes, how do you advertise your public IP address block to each ISP? HTH, Meheretab
... View more
Hi Chris, Could you share your configurations? We need to know what routing protocol you configured, and whether important multicast config is missing somewhere. When you add ip igmp join-group 239.0.1.2, you are informing that you are listening to that particular group. Is the phone also configured to listen to that particular multicast group? HTH, Meheretab
... View more
Hi, It looks like you are using the same network on both sites; that is the reason for connectivity failure between the two sites. If you share your configuration, we can provide more advise. HTH, Meheretab
... View more
Unfortunately, I do not have PacketTracer. Maybe somebody else will take a look and advise. I could take a look if you share the configurations though. Meheretab
... View more
I do not know any specific command to provide you the list of subnets you learned from OSPF neighbors. However, you can see how many subnets you learned from all of your neighbors as far as they made it to the RIB using show ip route summary (or show ip route summary | i ospf) HTH, Meheretab
... View more
Hi, I do not work on Cisco WLC so the information I provide you here could be different (as I work on Controllers from different vendor). Generally, if you configure the WLC with the SSIDs on the correct VLANs and the SVIs are configured on a switch where the DHCP server is configured as well, you do not need DHCP Proxy on the WLC. If the DHCP server is on a different LAN, then you will need DHCP Proxy on each SVI. The switchport connected with the APs need to be configured as a trunk port with the native VLAN on the AP management VLAN; the AP will get IP address from this VLAN. For clients connected with the SSID (eg. abc-ssid), they will get their IP address from the DHCP server providing IP address for the VLAN (which abc-ssid uses). If you provide your configurations, we can take a look. HTH, Meheretab
... View more
Hi, Did you check whether there is QoS configured? Could you share the config of the switches hiding sensitive information? HTH, Meheretab
... View more
.jpg "VIP Mentor"){kind=icon}
.jpg "Hall of Fame Mentor"){kind=icon}
