Sounds like you got it working then. And good question... After researching, according to QoS documentation for that switch, one specific difference between applying QoS to a physical interface vs. SVI is: "You can configure policing (either individual or aggregate policers) on a physical port or an SVI. When configuring policy maps on an SVI, you can create a hierarchical policy map and can define an individual policer only in the secondary interface-level policy map"   In other words, y ou can configure only individual policers on an SVI, not aggregate policers, in your policy maps.   https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960xr/software/15-2_4_e/configuration_guide/b_1524e_consolidated_2960xr_cg/b_1524e_consolidated_2960xr_cg_chapter_0100101.html   Depending on how you have your egress QoS configured, that may help you determine if one is better than the other in your particular situation?   Hope that helps... ... View more

I agree with what has already been stated above as well - that EIGRP is the more desirable option. Plus you have different options of how you can go about configuring the default route for advertisement through EIGRP. For example, redistribute static default-routes directly or with a route-map, or configure a default-route summary address on an appropriate interface, or even using a distribute-list referencing ACL permitting default route. ... View more

Just for clarification - are they unable to log back into Windows from the Windows logon screen? There is some history online on the Microsoft forums regarding this problem with Cisco AnyConnect installed where AnyConnect keeps a session.  Proposed solution is the following:   Change the following key in the registry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\ Set EnforceSingleLogon to 0   I tried checking my own registry and did not find this key, but perhaps the affected users have it on theirs?   Here's the link to the referenced post: https://social.technet.microsoft.com/Forums/en-US/d6f208d8-0763-4bc1-99b2-31593e051470/windows-10-vm-quotlogin-deniedquot-on-second-login-after-1709-update?forum=win10itprogeneral   Also check out this thread, last post suggests same fix with further info: https://community.cisco.com/t5/vpn-and-anyconnect/since-installing-anyconnect-cannot-switch-users-quot-only-one/m-p/3197691/highlight/true#M118515   Regards, CoolBreeze   P.S. Don't forget to rate all helpful posts! :-)   ... View more

Hi there, What kind of traffic is being initiated from vlan 100 to vlan 10?  What protocols? (IP, ICMP, UDP, TCP?)  And any specific traffic types involved? (HTTP, TFTP, FTP, DHCP, SSH, Telnet, etc?)   Are you wanting end result to completely allow all traffic from vlan 100 to vlan 10, but deny all IP traffic (except return traffic from an initiated vlan 100 connection) from vlan 10 to vlan 100?   Thanks!   ... View more

1)  Can you clarify what exactly is the end goal you are wanting?  It looks like all the class-maps "match any," based on ACL or ip dscp value specified - then the policy-map (re-)marks the traffic with same dscp value from the class-map match statements.  Is this the desired behavior?  Can you provide configs of your ACLs used for the class-map matching criteria also to help further clarify the end result?   2)  Is the issue also that the the service-policy input command is not displayed in the running-config of the SVI or the Gi1/0/37, so unsure if it was applied or not?  Are you able to execute and supply the output of these commands to verify the QoS? #show run all | beg Gi1/0/37      (need include only the output for that interface) #show run all | interface vl 20     (need include only output for that interface) #show policy-map MARK_INPUT #show policy-map interface Gi1/0/37 #show policy-map interface vl 20 Wasn't exactly sure why the service-policy cmd was applied on both the SVI and the physical interface... The below is from the QoS configuration guide for  C2960XR running 15.2(4)E code, indicating to do either one or the other -   "Follow these guidelines when configuring policy maps on physical ports or SVIs:   You cannot apply the same policy map to a physical port and to an SVI. If VLAN-based QoS is configured on a physical port, the switch removes all the port-based policy maps on the port. The traffic on this physical port is now affected by the policy map attached to the SVI to which the physical port belongs."   ... View more

So ironically I experienced this error myself over the weekend. However, in my situation, I was unable to reach our VPN server due to our carrier experiencing a circuit outage / fiber cut.  So the specific server itself I was pointing to was unreachable. Are you able to confirm other end users are able to VPN to the inside network successfully using the same server you are?   To verify your address - when you first launch AnyConnect a window pops up with a "Connect" button.  Next to the left of the connect button is like a dropdown box with a group name, hostname or IP address. You can also check in C:\ProgramData\Cisco\AnyConnect\Profile\ in a Windows explorer box to see if you  can find some sort of xml profile file.  Look under Server List inside of the xml.   Adding picture of basic AnyConnect client connection box.   ... View more

Are the affected users remote? Working wired or wirelessly, and connecting via AnyConnect?   Are those the only NAM errors shown in Dart?   Do the Windows event logs show anything significant on the client machines regarding the login failures? ... View more

Do you have a valid Internet/network connection?  (ie have a valid IP address, can ping the local gateway, and get to the Internet, etc) Check also the VPN server address you are trying to connect to is correct in the AnyConnect window. If you are unsure what you are trying to connect as, you can check the Server List section of the AnyConnect VPN client profile .xml to view the hostname and IP address. On a Windows machine it is probably under something like example: C:\ProgramData\Cisco\AnyConnect\Profile\myprofile.xml   On a Mac, try looking for an /opt/cisco/anyconnect/profile/ folder with vpn profile .xml inside.   Hope that helps!       ... View more

Assuming the Firewall is acting as a layer 3, it is making a layer 3 boundary. I would suggest either subnetting the network if the user absolutely insists on keeping that block of addresses for whatever reason, or explain to them how networks work, so they will understand why a network can't span a layer 3 boundary and that it would be best to just re-IP the WiFi router or change its connection to the .128 switch :)   For subnetting, put the 172.16.128.0/19 (255.255.224.0) on the .64 switch so the router can keep the 172.16.128.3 IP, and then put 172.16.160.0/19 (255.255.224.0) on the current .128 switch - though the switch will need a new IP itself then in that case as well. ... View more

Ok...that kinda brings me back to asking how the switches are separated - via Layer 2, or Layer 3 via the Juniper Firewall? If the Firewall is acting as a layer 3 boundary itself, you can't have a single network span a layer 3 boundary (easily or even practically anyway). You COULD further subnet your .128 network with like a /19 instead, putting one half on one switch and one half the other and advertising the routes accordingly based on the appropriate mask.   If the Firewall is acting as a layer 2 device, then try putting all routing on the 172.16.64.2/18 switch along with a management VLAN & SVI, and then swapping the 172.16.128.2/18 SVI with an IP in the newly created management VLAN.   Hope that helps.   ... View more

Are you unable to assign the WiFi router an IP in the subnet on the 172.16.64.2 switch? Or connect it to the 172.16.128.2 switch? Or, are you able to do a routed port to the WiFi with a /30 network, and do a static route to the /30 IP or routed interface of the WiFi? ... View more

Sorry, just saw the diagram of the network and somehow missed all the posts after that.  Whoops. So just curious, how is the Firewall configured to act between the switches? Agree to request posting the now current configs of both switches. ... View more

If a trunk is not being used, why would you not have IP addresses assigned on the non-switchport ports (Fa0/24) connecting the two switches?   Also, "ip routing" simply enables routing capabilities on the switch, such as basic inter-VLAN routing, and allows routing protocols to be configured.  But without routing protocols actually configured (such as EIGRP, OSPF, iBGP, etc), the switches aren't doing any dynamic routing other than between VLAN SVIs configured on the local switch.   If the SVIs are configured across two different L3 switches, I would think you would need either a static or dynamic route between them to forward traffic. In addition, if the VLANs are separated by a layer 3 boundary (ie routed port), then the VLAN id doesn't really matter either (although best practice is obviously not to use the default VLAN 1).     Otherwise if wanting a strictly layer 2 path between the switches, then a trunk allowing the specific VLANs in question across would suffice, with ideally some sort of third, management VLAN (with SVI configured on both switches) as the native VLAN; also make sure all relevant VLANs are on both switches, and configure the SVIs for all the VLANs on one of the switches to act as the routing point.   I wonder, does the OP want layer 3 separation and both switches acting as L3 devices, or is a layer 2 path with just inter-VLAN routing for communication needed?  Or is the Juniper Firewall device connected to both employing switching or routing at all between the switches, or just providing DHCP for clients? The design will also affect how the WiFi router mentioned has its IP and connected switchport configured.   Based on clarification of the desired end goal I can provide some sample configuration.   ... View more