Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About lonelyadmin
Stats
Member since
10-06-2017
21
Posts
0
Helpful
1
Solution
06-18-2019
05:58 AM
Coming from a netscreen/junos background... For allowing access to the inside from a DMZ IP I'd usually configure a VIP using an IP in the DMZ network that would map/nat to an IP on the inside interface and apply the appropriate acl/policies to that mapping. This would keep, somewhat, our internal IP schema from DMZ assets...less info is better, right? I can't for the life of me figure out how to do this on the ASA. All the examples I find just do a typical NAT to where the DMZ server communicates directly with your internal IP. It looks like to create any virtual IP you have to create a subinterface and then configure the NAT and ACLs to that. Is that how to do this on an ASA? It just didn't seem right to me. ASA 5516X running 9.10 Thanks.
... View more
- Tags:
- vip
Labels:
05-07-2019
02:25 PM
Thanks, I saw those before I posted. They don't really say if it should be there on the deny or not. Not mentioned in 4500X docs either. I opened a case with TAC too. I'll update here.
... View more
05-07-2019
12:32 PM
This is on a 4500X running 03.08.06.E There doesn't seem to be a cookie option under the deny statements in an extended ip access-list. ip access-list extended FOO
switch01(config-ext-nacl)#permit ip any object-group BLOCKED log ?
WORD User defined cookie (max of 64 char)
dscp Match packets with given dscp value
fragments Check non-initial fragments
option Match packets with given IP Options value
precedence Match packets with given precedence value
reflect Create reflexive access list entry
time-range Specify a time-range
tos Match packets with given TOS value
<cr>
switch01(config-ext-nacl)#deny ip any object-group BLOCKED log ?
dscp Match packets with given dscp value
fragments Check non-initial fragments
option Match packets with given IP Options value
precedence Match packets with given precedence value
time-range Specify a time-range
tos Match packets with given TOS value
<cr> No "WORD" option shown. Is this intentional or some sort of bug?
... View more
Labels:
05-03-2019
01:19 PM
My only reason to filter it is that it doesn't need to be there. I can't think of any reason why an end user would need to receive HSRP traffic. Would blocking the src/dst mac and IP block any other traffic or is it specific to that particular instance of HSRP? Can you show an example of how to block HSRP on the access ports? Thanks!
... View more
05-03-2019
01:09 PM
...I tried removing icmp so that the group would only be IP, no luck
... View more
05-03-2019
01:08 PM
I'm having trouble on an outbound vlan access map. I'm trying to get it to allow packets from 192.168.20.20 tcp/445 but the only way I can do it is manually entering the "expanded" version of the command. object-group service cifs
description smb/cifs ports
icmp echo
tcp eq 139
tcp eq 445
udp eq netbios-ns
udp eq netbios-dgm
icmp echo-reply
icmp traceroute
!
object-group network SERVER
host 192.168.20.20
! When I reference those using: ...
permit object-group cifs any object-group SERVER any
...
sh ip access-list FOO expanded
...
6 permit icmp host 192.168.20.20 any echo log
7 permit tcp host 192.168.20.20 any eq 139 log
8 permit tcp host 192.168.20.20 any eq 445 log
9 permit udp host 192.168.20.20 any eq netbios-ns log
10 permit udp host 192.168.20.20 any eq netbios-dgm log
11 permit icmp host 192.168.20.20 any echo-reply log
12 permit icmp host 192.168.20.20 any traceroute log Only focusing on 445...the above defines any packet from 192.168.20.20 from any tcp port to dst tcp 445) What I need it to expand to is: (any packet from 192.168.20.20 from tcp 445 to any dst host any dst port) permit tcp host 192.168.20.20 eq 445 any log <-- manually entering this works So, how can I use service and network object groups to achieve the (permit tcp host 192.168.20.20 eq 445 any log) format for all of the services in the service group? I'm quite possibly just doing it wrong :) EDIT I might have found it. I think by creating a new service group using "source" rather than "eq" it expands how I intended. I was hoping to use same object group for each way (IN/OUT) but whatever. object-group service cifs-src tcp source eq 445 tcp source eq 139 udp source eq netbios-ns udp source eq netbios-dgm !
... View more
Labels:
05-02-2019
11:22 AM
I have a relatively simple setup. 4500X L3 switches connected over trunks. Each L3 VLAN has a standby IP defined with a different priority on each switch. That standby IP is the gateway for that VLAN. 2960X L2 switches attach to the L3 switches with no L3 interface definitions (well there is one L3 vlan for VTP and other default VLAN type things to use, but no L3 for users interfaces). HSRP seems to function fine when a switch is rebooted or whatever. What I'd like to do is allow HSRP traffic where it is needed and block where it isn't. In my setup, allowing it on the trunks between switches and blocking it on every other interface seems to be the most sensible. What's the best recommendation for achieving that? I don't want to possibly affect any other multicast traffic by blocking HSRP broadcast traffic. Using wireshark on any of the interfaces I can see the HSRPv2 traffic sourced from the .2 or .3 IP addresses sent to 224.0.0.102 4500X's !4500X_primary
interface Vlan10
description users10
ip address 10.1.10.2 255.255.255.0
ip access-group VLAN_10_IN in
ip access-group VLAN_10_OUT out
ip helper-address 10.10.10.10
standby version 2
standby 1 ip 10.1.10.1
standby 1 priority 110
standby 1 preempt
standby 1 authentication md5 key-string random_string_cnbreu timeout 5
no autostate
!
!4500X_secondary
interface Vlan10
description users10
ip address 10.1.10.3 255.255.255.0
ip access-group VLAN_10_IN in
ip access-group VLAN_10_OUT out
ip helper-address 10.10.10.10
standby version 2
standby 1 ip 10.1.10.1
standby 1 priority 95
standby 1 authentication md5 key-string random_string_cnbreu timeout 5
no autostate
!
... View more
Labels:
11-05-2018
02:53 PM
2 asa 5516X with 2 4500X VSS pairs with about 12 2960X connecting to the 4500X's. L2 VLANS on the 2960X's, L3 VLANS on the 4500X's with VACLs between VLANs. IP routing enabled on 4500Xs. Traffic routing to the ASA is Internet or DMZ bound.
... View more
11-05-2018
02:00 PM
I have 2 ASA 5516 firewalls connected to 2 4500X VSS clusters over a LACP interface. There is a transit L3 vlan between the firewall that includes the inside interface on the ASA and is the default route on the 4500X's. Currently, whenever I define a new L3 VLAN on the switch I define a static route back to it on the inside interface on the firewall. No routing protocols are used anywhere. HSRP is used between the switches/vlans. Would there be any benefit to setting up OSPF on the firewall and switch? Other than keeping me from manually defining a route for each new VLAN does it really fix what isn't broken?
... View more
Labels:
10-19-2018
08:00 AM
<sigh>
Figured it out. Switch 3 did not have ip routing enabled...even though the command was in the script to configure it, the ios version was 152-6.E1 and not "E2" which evidently is the first one to support ip routing on the 2960.
So, upgraded ios,enabled ip routing, hsrp works as expected.
My apologies for wasting your time on this!
... View more
10-18-2018
02:30 PM
Here is the sh standby and sh int trunk for each switch.
switch1:
#sh standby Vlan1 - Group 1 (version 2) State is Active 4 state changes, last state change 02:36:24 Virtual IP address is 10.10.10.1 Active virtual MAC address is 0000.0c9f.f001 (MAC In Use) Local virtual MAC address is 0000.0c9f.f001 (v2 default) Hello time 3 sec, hold time 10 sec Next hello sent in 2.064 secs Preemption enabled Active router is local Standby router is 10.10.10.3, priority 90 (expires in 9.840 sec) Priority 100 (default 100) Group name is "hsrp-Vl1-1" (default) #sh int trunk
Port Mode Encapsulation Status Native vlan Gi0/1 on 802.1q trunking 1 Gi0/24 on 802.1q trunking 1
Port Vlans allowed on trunk Gi0/1 1-4094 Gi0/24 1-4094
Port Vlans allowed and active in management domain Gi0/1 1-2 Gi0/24 1-2
Port Vlans in spanning tree forwarding state and not pruned Gi0/1 1-2 Gi0/24 1-2
switch2:
#sh standby Vlan1 - Group 1 (version 2) State is Standby 4 state changes, last state change 02:33:41 Virtual IP address is 10.10.10.1 Active virtual MAC address is 0000.0c9f.f001 (MAC Not In Use) Local virtual MAC address is 0000.0c9f.f001 (v2 default) Hello time 3 sec, hold time 10 sec Next hello sent in 0.624 secs Preemption disabled Active router is 10.10.10.2, priority 100 (expires in 9.456 sec) MAC address is 70d3.7998.f440 Standby router is local Priority 90 (configured 90) Group name is "hsrp-Vl1-1" (default) #sh int trunk
Port Mode Encapsulation Status Native vlan Gi0/1 on 802.1q trunking 1 Gi0/2 on 802.1q trunking 1
Port Vlans allowed on trunk Gi0/1 1-4094 Gi0/2 1-4094
Port Vlans allowed and active in management domain Gi0/1 1-2 Gi0/2 1-2
Port Vlans in spanning tree forwarding state and not pruned Gi0/1 1-2 Gi0/2 1-2
switch3:
#sh standby Vlan1 - Group 1 (version 2) State is Active 5 state changes, last state change 02:33:30 Virtual IP address is 10.10.10.1 Active virtual MAC address is 0000.0c9f.f001 (MAC In Use) Local virtual MAC address is 0000.0c9f.f001 (v2 default) Hello time 3 sec, hold time 10 sec Next hello sent in 1.856 secs Preemption disabled Active router is local Standby router is unknown Priority 80 (configured 80) Group name is "hsrp-Vl1-1" (default
#sh int trunk
Port Mode Encapsulation Status Native vlan Gi0/24 on 802.1q trunking 1
Port Vlans allowed on trunk Gi0/24 1-4094
Port Vlans allowed and active in management domain Gi0/24 1,888
Port Vlans in spanning tree forwarding state and not pruned Gi0/24 1,888
... View more
10-18-2018
02:26 PM
Real switches. WS-2960L-24PS-LL 15.2-6E2 (E1 same behavior)
switch1:
#sh run | inc span spanning-tree mode rapid-pvst spanning-tree extend system-id spanning-tree vlan 1 priority 0
#show spanning-tree vlan 1
VLAN0001 Spanning tree enabled protocol rstp Root ID Priority 1 Address 70d3.7998.f400 This bridge is the root Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 1 (priority 0 sys-id-ext 1) Address 70d3.7998.f400 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 sec
switch2:
#show spanning-tree vlan 1
VLAN0001 Spanning tree enabled protocol rstp Root ID Priority 1 Address 70d3.7998.f400 Cost 4 Port 1 (GigabitEthernet0/1) Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 32769 (priority 32768 sys-id-ext 1) Address 2c86.d201.2880 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 sec
#sh run | inc span spanning-tree mode rapid-pvst spanning-tree extend system-id
switch3:
show spanning-tree vlan 1
VLAN0001 Spanning tree enabled protocol rstp Root ID Priority 1 Address 70d3.7998.f400 Cost 8 Port 24 (GigabitEthernet0/24) Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 32769 (priority 32768 sys-id-ext 1) Address 70d3.7999.2980 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 sec
#sh run | inc span spanning-tree mode rapid-pvst spanning-tree extend system-id
... View more
10-18-2018
11:54 AM
They were all default v1, I changed to v2. Behavior is unchanged.
... View more
10-18-2018
11:24 AM
Yes, and it is, the problem is that switch 3 also becomes active.
... View more
10-18-2018
11:23 AM
Yes. Pings between .2, .3, and .4 always work. .1 is different as it's basically a dup IP with 2 actives.
... View more
06-18-2019
Coming from a netscreen/junos background... For allowing access to the
inside from a DMZ IP I'd usua...
05-07-2019
Thanks, I saw those before I posted. They don't really say if it should
be there on the deny or not....
05-07-2019
This is on a 4500X running 03.08.06.EThere doesn't seem to be a cookie
option under the deny stateme...
Created by
lonelyadmin
in Switching
05-03-2019
05-03-2019
My only reason to filter it is that it doesn't need to be there. I can't
think of any reason why an ...
05-03-2019
I'm having trouble on an outbound vlan access map. I'm trying to get it
to allow packets from 192.16...
Created by
lonelyadmin
in Switching
05-02-2019
05-02-2019
I have a relatively simple setup.4500X L3 switches connected over
trunks. Each L3 VLAN has a standby...
11-05-2018
2 asa 5516X with 2 4500X VSS pairs with about 12 2960X connecting to the
4500X's. L2 VLANS on the 29...
11-05-2018
I have 2 ASA 5516 firewalls connected to 2 4500X VSS clusters over a
LACP interface. There is a tran...
10-19-2018
Figured it out. Switch 3 did not have ip routing enabled...even
though the command was in the scrip...
10-18-2018
Here is the sh standby and sh int trunk for each switch. switch1: #sh
standby Vlan1 - Group 1 (versi...
10-18-2018
Real switches. WS-2960L-24PS-LL 15.2-6E2 (E1 same behavior) switch1: #sh
run | inc spanspanning-tree...
Public Statistics
| Date Registered | 10-06-2017 01:40 PM |
| Date Last Visited | 06-19-2019 08:54 AM |
| Total Messages Posted | 21 |
.jpg "VIP Advisor"){kind=icon}
