Hello fellow experts,   We are facing some issues in our Catalyst stack switches that makes them unresponsive for administration. Actually we have some 802.1X configuration against a third party vendor, and sometimes we are getting a bunch of messages of this type: %DOT1X_SWITCH-5-ERR_VLAN_EQ_VVLAN: Data VLAN <<>> on port <<PORT>> cannot be equivalent to the Voice VLAN AuditSessionID 2 The issue is not on all ports, but in 2 or 3 of them. When it appears the switches logs gets full quickly and the switches started to answer with several seconds of delay, making them innaccesible by VTY or even by SNMP. We think the issue is caused by some wrong configuration in some clients (IP phones) and we are looking further in that way, but we need to stop the blocking behaviour, it appears that the logging speed is so high that the system is not capable of writing all the logs down, and that I/O bottleneck is causing the switch to get stuck.   Is there anyway we can stop that logs writing to the flash, or at least reducing its appereance? Or, better, it is possible to configure some ERR-Disable policy for blocking those ports in the moment it appears the misconfiguration? We have digged the CISCO documentation and the only related stuff we found was "Change either the voice VLAN or the IEEE 802.1x-assigned VLAN on the interface so that they are not the same.", but is not enough to stop the blocking.   Any idea will be appreciated.   Best regards.   ... View more

Hello fellow experts,   We are having a pretty rough time trying to configure a NAT/PAT in one of our internet routers, and i think someone here can help us with some ideas. The scenario is this: We have a router connected to internet and performing NAT overload to allow our users to navigate with the public IP address (just one) while masking our internal private IPs. We need to expose one service to internet over the same IP address (lets say some webpage at port 8080), and need to configure the incoming connections to be routed to some specific internal IP without disrupting our users internet connectivity. Sadly, we dont have other public IP address to NAT the connection over other IP, and we are looking at many examples over the internet but we dont find some suitable method to configure a NAT pool or ACL to allow the incoming connection specifically. Can someone advice something to us about this?   Our router working configuration is this (similar, btw): interface GigabitEthernet0/0/0 description OUTSIDE_ADDRESS ip address <<OUTSIDE PRIVATE ADDRESS>> ip nat outside interface GigabitEthernet0/0/1.1 description INSIDE_ADDRESS encapsulation dot1Q 1 ip address <<INSIDE PRIVATE ADDRESS>> ip nat inside ip nat pool NAME <<PUBLIC IP>> <<PUBLIC IP>> netmask <<MASK>> ip nat inside source list 3 pool NAME overload ip route 0.0.0.0 0.0.0.0 <<OUTSIDE PRIVATE ADDRESS NEXT-HOP>> access-list 3 permit <<INSIDE PRIVATE ADDRESS>> <<MASK>> And we need to allo that someone outside can open some webpage at <<PUBLIC IP>>:8080 that will be routed to some internal private IP address.   Is this even possible?   Thanks at advance and best regards!   ... View more