About EduardR

EduardR · ‎04-03-2018

I think you almost have everything done... Just some minor tweaks: You must configure the NAT for the inside interfaces (Fe0 to Fe3) interface fastethernet 0 ip nat inside interface fastethernet 1 ip nat inside interface fastethernet 2 ip nat inside interface fastethernet 3 ip nat inside You define the NAT for the outside interface interface fastethernet 4 ip nat outside Use your nat definition: ip nat pool NAME 10.2.1.74 10.2.1.74 prefix 24 <--- i think... Indicate the translation: ip nat inside source list 1 pool NAME overload access-list 1 permit 192.168.1.0 0.0.0.255 Also, i think you need a route to the outside... something like: ip route 0.0.0.0 0.0.0.0 <IP OF THE INTERNET NEXT HOP> ANd with that i think you can connect your endpoints to the internet.

EduardR · ‎04-02-2018

You can make an extended ACL pointing to the device IP like this: ip access-list extended NoSSH deny tcp host <IP> any eq 22 permit ip any any and apply it to each of the SVI, for example: ip access-list extended NoSSH deny tcp host 10.2.0.1 any eq 22 permit ip any any interface vlan 10 ip access-group NoSSH in

EduardR · ‎04-02-2018

Hi By default, your device answer ssh connections from all the interfaces VLAN, you can restrict that by using ACL that prohibits incoming SSH in the interfaces you want to

EduardR · ‎04-02-2018

Yes, you can connect the router directly to the L3 switch, the easiest way (imho) is to make anothe subinterface with 802.1q on the router, asign one IP to the router and other to the switch in the same network, and make the proper static routes.

EduardR · ‎04-02-2018

You have duplicated IP addresses on switch and router. In your design, which device is gonna make the routing? the switch or the router?

EduardR · ‎04-02-2018

Hi, can you clarify where do you configure the SVI? In the L3 Switch or in the router? Can you share the configuration of the devices with the trouble?

EduardR · ‎04-02-2018

The native VLAN is something that t he IEEE 802.1Q trunking protocol describes as part of the protocol, and its just a VLAN in wich all traffic sent and received on an interface that is configured for 802.1Q won’t have a tag on its Ethernet frame. Thats it, if you have configured a native vlan 10, all the frames that arrives in that VLAN and that need to traverse a trunk port, will have its tag removed and pass like it was an access port. All the other VLAN will be tagged normally. You can see more about it here: https://networklessons.com/switching/802-1q-native-vlan-cisco-ios-switch/

EduardR · ‎04-02-2018

Hi, By any means do you have any F1/F2 cards mixed in the same VDC? it seems there is an scenario where it doesnt work...

EduardR · ‎04-02-2018

Hi, It seems you don't have a permit for telnet (port 23) to 63.147.191.66 traffic in your ACL. You have and permit ICMP any, permit for IP .67, .69, .70, and deny for all else.

EduardR · ‎04-02-2018

Hi, That command does 2 complementary actions, first, puts all ports on "Portfast", that means that the port does not goes thru the STP process (Blocking, Listen, Learning, Forwarding) but it goes directly to forwarding, but it keeps receiving and sending BPDUs. SO, theres the second part, it puts "BPDU Filter" on all the ports, that means that the port will stops receiving and sending those BPDUs.

EduardR · ‎04-02-2018

Hi, if you are trying to change the SSH port to connect to a device, you must configure a rotary group: ip ssh port 1000 rotary 1 ! line vty 0 15 rotary 1 This will make the device to open a SSH connection on the port "1000", but this will not prevent to connect to it in the port 22, you need to make an ACL to acomplish this too.

EduardR · ‎04-02-2018

Hi! I know it is a little pain to have 2 wated IP in a /30 network, but afaik is it not anything we can do about it, is how the protocol is defined. The network IP address is just there to identify the network and its often used for routing processes. The broadcast address is just the "all the host" address, and its used for some L2 behaviour (like the ARP requests).

EduardR · ‎03-22-2018

Hi all, I have an scenario where we got some subnet inside an EPG in an ACI Fabric (e.g. 10.10.10.0/24), the Gateway of that subnet is in the EPG's BD (10.10.10.250) and it routes all inside a L3Out to a Nexus7k CORE using OSPF as the routing protocol. With this configuration all is working fine. The problem is that inside that EPG is a Firewall (e.g. 10.10.10.1), and we need to route 3 subnets to that IP address, and we do not know how to make the routing in the APIC. If the CORE were the Nexus7k, the task is a simply: ip route <NET> <MASK> 10.10.10.1 Because the N7k knows that host, but with the ACI Fabric and the OSPF is not so easy. We can not route it directly (as the example above), neither can route it to the OSPF peer interfaces because the Fabric knows just the 10.10.10.0/24 network, but not the 3 new subnets. Does anyone knows how to do this in the Fabric?

EduardR · ‎03-22-2018

Yo usaría para iniciar el que te está funcionando normal en el otro Catalyst, debes reiniciar el switch con inconvenientes en modo ROMON y ejecutar el procedimiento de cambio de IOS

EduardR · ‎03-22-2018

Hola, Creo que puedes encontrar la respuesta en el otro hilo que abriste: ACA

Date Registered	‎10-18-2017 01:33 PM
Date Last Visited	‎05-17-2018 01:52 AM
Total Messages Posted	55
Total Helpful Votes Received	25

Re: Cisco 881 router in a subnet

Re: ssh access to Layer 3 specific inte...

Re: ssh access to Layer 3 specific inte...

Re: Inter-VLAN Routing query

Re: Inter-VLAN Routing query

Re: Inter-VLAN Routing query

Re: Mangment vlan

Re: N7K problem installation new line c...

Re: TCP access denied by ACL

Re: spanning-tree portfast bpdufilter d...

Re: change SSH port Number

Re: Purpose of network and broadcast ad...

Cisco ACI Fabric with static routes

Re: Problema arranque Switch Catalyst 3...

Re: Puedo configurar un AP como un rout...