Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Wan_Whisperer
Online
Stats
Member since
11-21-2017
45
Posts
20
Helpful
2
Solutions
Created by
Wan_Whisperer
in Network Management
in Network Management
09-20-2019
04:15 AM
09-20-2019
04:15 AM
Seb, Thanks for the info. I am using this as a test: event manager applet BPS_UNDER event tag 1 interface name GigabitEthernet0/0/0 parameter receive_rate_bps entry-op lt entry-val 999999 entry-type value poll-interval 120 action 0.1 cli command "show run in gi0/0/0" action 0.2 regexp "(no shutown)" "$_cli_result" value action 0.3 if $_regexp_result eq "0" action 5.0 syslog msg "EEM SHUT G0/0/1" I get the following err BPS_UNDER: Missing "end" action in conditional block Can you explain this? Once I get this working I will use the following config: event manager applet BPS_UNDER event tag 1 interface name GigabitEthernet0/0/0 parameter receive_rate_bps entry-op lt entry-val 999999 entry-type value poll-interval 120 action 0.1 cli command "show run in gi0/0/0" action 0.2 regexp "(no shutdown)" "$_cli_result" value action 0.3 if $_regexp_result eq "0" action 1.0 cli command "enable" action 2.0 cli command "config t" action 3.0 cli command "interface g0/0/0" action 4.0 cli command "shut" action 5.0 syslog msg "Interface g0/0/0 was shut via EEM" How does that look?
... View more
Created by
Wan_Whisperer
in Network Management
in Network Management
06-14-2019
12:01 AM
06-14-2019
12:01 AM
I have two EEM running on one device (see below) I really do not want it to repeat the no shut command every 180 seconds. Is there a way to have it detect the current configuration before changing it? For example using "TEST_BPS_IN" this test to see if the receive rate is below 3000 bits/sec then it shuts an interface....once its is shut I do not want it sending the shut command again every 180 seconds if the data remains below 3000 bits/sec. event manager applet TEST_BPS_IN event tag 1 interface name GigabitEthernet0/0/0 parameter receive_rate_bps entry-op lt entry-val 3000 entry-type value poll-interval 180 action 1.0 cli command "enable" action 2.0 cli command "config t" action 3.0 cli command "interface g0/0/0" action 4.0 cli command "shut" action 5.0 syslog msg "Interface g0/0/0 was shut via EEM" event manager applet TEST_BPS_OVER event tag 1 interface name GigabitEthernet0/0/0 parameter receive_rate_bps entry-op gt entry-val 10000 entry-type value poll-interval 180 action 1.0 cli command "enable" action 2.0 cli command "config t" action 3.0 cli command "interface g0/0/0" action 4.0 cli command "no shut" action 5.0 syslog msg "Interface g0/0/0 was no shut via EEM"
... View more
Labels:
Created by
Wan_Whisperer
in Network Management
in Network Management
06-13-2019
11:34 PM
06-13-2019
11:34 PM
Replying to myself to maybe help someone else. I have it working in a test state and here is my configs: event manager applet TEST_BPS_IN event tag 1 interface name GigabitEthernet0/0/0 parameter receive_rate_bps entry-op lt entry-val 3000 entry-type value poll-interval 180 action 1.0 syslog msg "EEM Test Worked Value over 3000 bits/sec in" event manager applet TEST_BPS_OVER event tag 1 interface name GigabitEthernet0/0/0 parameter receive_rate_bps entry-op gt entry-val 10000 entry-type value poll-interval 180 action 1.0 syslog msg "EEM Test Worked Value over 10000 bits/sec in" I will run this for a week and check logs to ensure it works like I expect then I will use these configs: event manager applet TEST_BPS_IN event tag 1 interface name GigabitEthernet0/0/0 parameter receive_rate_bps entry-op lt entry-val 3000 entry-type value poll-interval 180 action 1.0 cli command "enable" action 2.0 cli command "config t" action 3.0 cli command "interface g0/0/0" action 4.0 cli command "shut" action 5.0 syslog msg "Interface g0/0/0 was shut via EEM" event manager applet TEST_BPS_OVER event tag 1 interface name GigabitEthernet0/0/0 parameter receive_rate_bps entry-op gt entry-val 10000 entry-type value poll-interval 180 action 1.0 cli command "enable" action 2.0 cli command "config t" action 3.0 cli command "interface g0/0/0" action 4.0 cli command "no shut" action 5.0 syslog msg "Interface g0/0/0 was no shut via EEM" I will update once I use the finial configs
... View more
Created by
Wan_Whisperer
in Network Management
in Network Management
06-12-2019
06:08 AM
06-12-2019
06:08 AM
All, I am brand new to EEM and have a good understanding but I need some clarification. Long story short I am duel homed and sometimes but very rare data switches and enters my secondary router. Without writing a 10 page essay on my network I would like to have the primary router use an applet to check incoming data. If the incoming data is "5 minute input rate 200000 bits/sec, 5 packets/sec" or lower then I want to shut interface G0/0/0. Here is what I have so far but I need to understand 100% what each command is before I test and deploy. event manager applet BPS_IN This creates the EEM and names it event tag 1 interface name FastEthernet0 parameter receive_rate_bps entry-op lt entry-val 20000 entry-type value poll-interval 180 I understand this unit "entry-op lt entry-val 20000" I assume that entry-op compares the data BPS received and "It" compairs it to "enty-cla" is this right so far? I want to take action if less than this " 5 minute input rate 20000 bits/sec, 5 packets/sec" . Not sure how to enter this amount in the above statement. action 1.0 cli command "enable" action 2.0 cli command "config t" action 3.0 cli command "interface g0/0/0" action 4.0 cli command "shut" action 5.0 syslog msg "Interface g0/0/0 was shut via EEM" I understand all of the actions Once complete I will remove all actions except 5.0 so I can test. How does this sound. Thanks everyone!
... View more
Labels:
05-23-2019
03:40 AM
Jon, I agree with putting the VPN on the outside. In my case I don't know how it can be done with my topology and need for redundant VPN. My two (Core1 and Core2) inside interfaces are redundant Via HSRP but my outsides are not (I do not want to buy a 10g Switch to make this possible) (maybe there is a way I don't know of) So I am trying to engineer a way to have redundant VPN and with out my outside being redundant I am trying to place it on my inside. any suggestions or thoughts? :)
... View more
05-23-2019
02:44 AM
This is my setup. I have a sub-interface with private IPs that also uses HSRP. I also have "ip nat inside" on the sub interface but have excluded networks going through the VPN. I have the VPN source 192.168.100.1 one-to-one NAT to a public IP 1.1.1.1. (not really 1.1.1.1) on my Edge router The second HSRP router is off to eliminate any extra issues, so Core1 is active (see "show standby brief below)" The VPN looks up. It looks like the Crpto map is not catching the Private IPs If I trace from a computer with the IP of 192.168.100.25 It hits 192.168.100.2 then to the Edge device. It should not do this, it should go through the VPN I also made sure that 192.168.100.25 is not being natted on Core1 ---------------------------------------------------------------- Configs on Core1 crypto isakmp key TESTKEY address 1.1.1.1 ! ! crypto ipsec transform-set MYSET esp-aes 256 esp-md5-hmac mode tunnel ! ! ! crypto map BWI 1 ipsec-isakmp description To-Remote set peer 1.1.1.1 set transform-set MYSET match address To-Remote-VPN interface GigabitEthernet0/0/0.100 description Private encapsulation dot1Q 100 ip address 192.168.100.2 255.255.255.0 no ip redirects ip nat inside standby 100 ip 192.168.100.1 standby 100 name Vlan100 standby 100 track 1 decrement 60 cdp enable crypto map BWI redundancy Vlan100 ip access-list extended To-Remote-VPN permit ip 192.168.100.0 0.0.0.255 10.10.10.0 0.0.0.255 log ip access-list extended NAT-SOURCE deny ip 192.168.100.0 0.0.0.255 10.10.10.0 0.0.0.255 deny ip host 192.168.100.2 any //////////////// I do not think I need this but I added just to be safe///////////// deny ip host 192.168.100.1 any //////////////// I do not think I need this but I added just to be safe///////////// permit ip 192.168.100.0 0.0.0.255 any ----------------------------------------------------- Show commands below. Core1#sho crypto isakmp sa IPv4 Crypto ISAKMP SA dst src state conn-id status 192.168.100.1 1.1.1.1 QM_IDLE 1003 ACTIVE Core1#sho crypto ipse sa interface: GigabitEthernet0/0/0.100 Crypto map tag: BWI, local addr 192.168.100.1 protected vrf: (none) local ident (addr/mask/prot/port): (192.168.100.0/255.255.255.0/0/0) remote ident (addr/mask/prot/port): (10.10.10.0/255.255.255.0/0/0) current_peer 1.1.1.1 port 500 PERMIT, flags={origin_is_acl,} #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0 #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts compr. failed: 0 #pkts not decompressed: 0, #pkts decompress failed: 0 #send errors 0, #recv errors 0 local crypto endpt.: 192.168.100.1, remote crypto endpt.: 1.1.1.1 plaintext mtu 1500, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0/0.100 current outbound spi: 0x0(0) PFS (Y/N): N, DH group: none inbound esp sas: inbound ah sas: inbound pcp sas: outbound esp sas: outbound ah sas: outbound pcp sas: /////////////////////////////////////////////as you can see the VPN is up/////////////////////////////////// SCore11#sho stan b P indicates configured to preempt. | Interface Grp Pri P State Active Standby Virtual IP Gi0/0/0.10 100 150 P Active local unknown 192.168.100.1 ----------------------------------------------------------------------- To recap: The VPN is up but it seems like the IPs 192.168.100.0/24 are not hitting the crypto map entering or exiting. I feel like this is a simple fix. I feel like I am just overlooking something. I have setup VPNs hundreds of time but not like this... If I send packets for the remote side and issue the command "sho crypto ipse sa" I can see packets getting encrypted and if I issue the same command on Core1 I do not see any packets being decrypted. Thanks for your input :)
... View more
Labels:
04-30-2019
02:20 AM
Jon, Not all heroes wear capes! You are the Bomb.com Thanks again...all I needed to do is explicitly list each static NAT in the ACL just like you said.
... View more
04-30-2019
01:51 AM
Paul, I replied to Georg, the only reason I use the Route map on my static NAT's is to ensure when a packet with a source address of 192.168.1.101 going to 10.1.1.0/24 or 10.1.2.0/24 will not NAT but if it goes to any other network it will NAT
... View more
04-30-2019
01:47 AM
Georg, Thanks for the input but....If I remove the route map then how will I tell the Static NAT, not to NAT when going to the 10.1.1.0 0.0.0.255 network?
... View more
04-30-2019
12:34 AM
All, I have an Issue where I have a network 192.168.1.0/24 needs to have static NAT for two devices and NAT overload for the remainder. The static NAT's are working but the Overload is not....... The public IP's below are hidden but highlighted in ORANGE. My setup interface GigabitEthernet0/1 Description to Core ip nat inside ip address x.x.x.x ! interface GigabitEthernet0/2 Description to Rourter7 ip nat outside ip address x.x.x.x ! ip nat pool Pool1 X.X.X.100 X.X.X.100 netmask 255.255.255.0 ***Just using one IP for NAT overload*** ! ip nat inside source static 192.168.1.101 X.X.X.101 route-map StaticRM ip nat inside source static 192.168.1.102 X.X.X.102 route-map StaticRM ! ip nat inside source list NAT pool Pool1 overload ! ip access-list extended NAT ***If I do not have this, then my static NAT are ignored and everything is NAT overloaded*** deny ip host 192.168.1.101 any deny ip host 192.168.1.102 any permit ip 192.168.1.0 0.0.0.255 any ! ip access-list extended StaticNat deny ip 192.168.1.0 0.0.0.255 10.1.1.0 0.0.0.255 ***Do not want this static not when going to Router7*** deny ip 192.168.1.0 0.0.0.255 10.1.2.0 0.0.0.255 ***Do not want this static not when going to Router7*** permit ip 192.168.1.0 0.0.0.255 any ! route-map StaticRM permit 10 ***I have this because I need to exclude the Static NAT for some networks going to Router7*** match ip address StaticNat ! Thanks in advance!
... View more
- Tags:
- nat
Labels:
04-22-2019
10:50 AM
************** Cisco IOS XE Software, Version 03.13.10.S - Extended Support Release Cisco IOS Software, ASR1000 Software (X86_64_LINUX_IOSD-UNIVERSALK9-M), Version 15.4(3)S10, RELEASE SOFTWARE (fc1) ******************* what is this? %FMFP_URPF-3-LIST_DOWNLOAD: SIP0: fman_fp_image: Unicast RPF list create for list 480996 fail to download because No space left on device. %CPPOSLIB-3-ERROR_NOTIFY: SIP0: fman_fp_image: fman-fp encountered an error -Traceback= 1#aa832e8341ab3547c222fa51fdae9652 errmsg:7FAEAE38F000+121D cpp_common_os:7FAE943F3000+DC08 cpp_common_os:7FAE943F3000+1B77E cpp_cef_mpls_common:7FAE9600B000+41B7B cpp_cef_mpls_common:7FAE9600B000+1A5FC cpp_cef_mpls_common:7FAE9600B000+1E718 :400000+73E206 :400000+379074 aobjman:7FAEB71AB000+D4AC :400000+521B5A evlib:7FAE9895E000+BB8F evlib:7FAE9895E000+E200 :400000+521873 c:7FAE84F1F000+1E514 I am having these errors and I can reach some IPs on my network from only a few different sources. Not sure the above message is related but It started at the same time.
... View more
Labels:
03-25-2019
12:21 PM
Everyones reply got me thinking about order of operation and I figured it out! For some reason when I add the route map to the one to one nat it hits the NAT overload first. Once I exclude the one to one from the NAT Overload it hits the One to One then hits the routemap! So it works!
... View more
03-22-2019
12:45 PM
Paul, I do have a second stack but it is powered off. The mapping ID are the same on both sides. I will exclude the static from the dynamic....just have not done it yet. to recap.....when I remove the Route map in the static route it works....so I feel like my route map is written incorrectly because one I add it noting it natted 1 to 1. Feels like my route map or its nested ACL is just excluding every thing.
... View more
03-22-2019
12:30 PM
That was a typo.....it is permit ip 172.19.150.0 0.0.0.255 any I fixed it on the Post. Any more thoughts?
... View more
03-22-2019
11:29 AM
Okay, I have googled and I can't seem to understand why "ALL" my static NATs are excluded and they are failing over to NAT Overload. NAT So I have a private network 172.19.150.0/24 that is NAT overload but some are static inside that network. I need to exclude all static NAT to some networks. I am 90% it because of my Route Map. What is happening is when I apply the Route map to the static NAT it is excluding the NAT to all netowrks and not the ones in my ACL and then hitting my NAT overload. I think its my Route map because when I remove the route map on the static NAT the 1 to 1 NAT works and when I add the Route map the statics don't work to any network and they Nat to my overload IP address. See configs below: ip nat pool Pool1 191.XXX.XXX.1 191.XXX.XXX.1 netmask 255.255.255.0 ip nat inside source static 172.19.150.125 191.XXX.XXX.49 route-map Static_Nat_RM redundancy 1 mapping-id 6 ip nat inside source static 172.19.150.190 191.XXX.XXX.93 route-map Static_Nat_RM redundancy 1 mapping-id 15 ip nat inside source list NATSource pool Pool1 redundancy 1 mapping-id 1 overload route-map Static_Nat_RM permit 10 match ip address Static_Nat_ACL ip access-list extended Static_Nat_ACL deny ip host 172.19.150.190 103.XXX.XXX.0 0.0.3.255 permit ip 172.19.150.0 0.0.0.255 any ! ip access-list extended NATSource permit ip 172.19.150.0 0.0.0.255 any When I am on 172.19.150.190 and I ping 8.8.8.8 I can see: 172.19.150.190 translating to 191.XXX.XXX.1 When I am on 172.19.150.190 and I ping 103.XXX.XXX.0 I can see: 172.19.150.190 translating to 191.XXX.XXX.1 When I ping 8.8.8.8 from 172.19.150.190 I want it to translate to 191.XXX.XXX.93 but its not. ********************************************************************************************** If I remove my Route map from the static nat: BEFORE: ip nat inside source static 172.19.150.190 191.XXX.XXX.93 route-map Static_Nat_RM redundancy 1 mapping-id 15 AFTER: ip nat inside source static 172.19.150.190 191.XXX.XXX.93 redundancy 1 mapping-id 15 and I get on 172.19.150.190 and I ping 8.8.8.8 I can see: 172.19.150.190 translating to 191.XXX.XXX.93 Sooo. It seems like something is wrong with my router map because I add it and noting is 1 to 1 natted at all...It just catches the NAT overload. ****edit*** Is it possible that it hitting the Overload NAT before it hits the static NAT? Is my Route Map written incorrectly? (PS I see no hits on my ACL under the route map Thanks,
... View more
Labels:
09-20-2019
Seb, Thanks for the info. I am using this as a test:event manager applet
BPS_UNDERevent tag 1 interf...
Created by
Wan_Whisperer
in FirePOWER
07-26-2019
07-26-2019
I plan to buy a 5515 with FP and a 1 year TAMC licenses. This will
replace my 5510. I do not underst...
06-14-2019
I have two EEM running on one device (see below) I really do not want it
to repeat the no shut comma...
Created by
Wan_Whisperer
in Network Management
06-13-2019
06-13-2019
Replying to myself to maybe help someone else. I have it working in a
test state and here is my conf...
06-12-2019
All, I am brand new to EEM and have a good understanding but I need some
clarification. Long story s...
Created by
Wan_Whisperer
in Routing
05-23-2019
05-23-2019
Jon, I agree with putting the VPN on the outside. In my case I don't
know how it can be done with my...
Created by
Wan_Whisperer
in Routing
05-23-2019
05-23-2019
This is my setup. I have a sub-interface with private IPs that also uses
HSRP. I also have "ip nat i...
04-30-2019
Jon, Not all heroes wear capes! You are the Bomb.com Thanks again...all
I needed to do is explicitly...
04-30-2019
Paul, I replied to Georg, the only reason I use the Route map on my
static NAT's is to ensure when a...
04-30-2019
Georg, Thanks for the input but....If I remove the route map then how
will I tell the Static NAT, no...
04-30-2019
All, I have an Issue where I have a network 192.168.1.0/24 needs to have
static NAT for two devices ...
04-22-2019
**************Cisco IOS XE Software, Version 03.13.10.S - Extended
Support ReleaseCisco IOS Software...
03-25-2019
Everyones reply got me thinking about order of operation and I figured
it out! For some reason when ...
03-22-2019
Paul, I do have a second stack but it is powered off. The mapping ID are
the same on both sides. I w...
Public Statistics
| Date Registered | 11-21-2017 10:24 AM |
| Date Last Visited | 09-20-2019 01:56 AM |
| Total Messages Posted | 45 |
| Total Helpful Votes Received | 20 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 5 |
.jpg "VIP Advisor"){kind=icon}
.jpg "Hall of Fame Guru"){kind=icon}
