Hi I was hopeing some one could explain how to do this. I am trying to restrict my core switchs (4506's) to only accept incomming SSH and Telent (managment) traffic that is directed to a single ip interface. I thought I could do this by placing a access list on the VTY lines that says #access list 101 permit tcp any host 192.168.1.254 eq 22 log #access list 101 permit tcp and host 192.168.1.254 eq 23 log #access list 101 deny ip any any log and simple assign that list inbound to the VTY interface. however this then blocks all access to the VTY line? the log is as shown Jan  8 11:41:54.247: %SEC-6-IPACCESSLOGP: list 101 denied tcp 192.168.5.25(4258) -> 0.0.0.0(22), 1 packet So i can see what is happening becasue the 4506 is the default gate way for the 192.168.5.0 network, it is seeing the packet as directed to self and no to the 192.168.1.254 address. My question is, is there any way around this. I was hoping to be able to restrict managment access to the 192.168.66.254 address, I dont want to stop other sub nets being able to manage this swith, but they would all ahve to mange it through a single IP address. this switch may end up with many subnet interfaces and I would rather be able to say allow this interface and deny all others by default, than have to manualy deny all other interfaces one by one. Any ideas how I can get this to work ? Cheers ... View more

Ok this is great. spent ages wondering how I could do this, even went as far as working out work around to achive this idea... then read the documentation and found out some one got there first!! anyway this is just what i needed. For reasons best left to BT, i ended up having to put my 1841 the oposite side of site to the rest of the network it routers for. with two choises to get the two connected. Run about 1km of fibre (a little of an over kill for a network of 10 end devices and a cheap ADSL link), or creating all the vlans on our main corprae network and trunking it across that. All i could think of was  why can't I trunk it all in one vlan to have as little effact on the corprate network as possible... So after  fiddeling around a bit, I bit the bullet and opened the configuration PDF..  It seems cisco have already thought of this and wow what simple config. 5 min later all up and running and working fine... a singel VLAN created on the corprate network. a single port either side configured as a tunnel and in effact I have turned my corprate network in to a very expensive and long eithernet cable between my 1841 and the switch it needs to connect to. (router on a stick setup) well fine untill I try to FTP across it... errrr whats all that about, it just stops.... Go back to read a bit more about it oh it seems I skiped the MTU bit.. have another look and theres the problem... that extra 4byte of valn tag is stopping it working!! DAMM!! so what I need to change the whole corprate network to support jumbo frames!! reboot every switch to update it!! (you have to reboot a cisco swith to update the MTU size!!) some how cant see manger agreeing with that... Ok next idea I can change the MTU on the router interface #int f0/0 #mtu 1490 Wow that did it, now the FTP works fine. But still some packets seem to be getting lost along the way, and 90% of webpages will not display? whats that all about?? I need a bit of help on the MTU side of things. how can i insure that my network will run using a smaller MTU size. the 1841 is running with a adsl wic installed (so running the ADSL link, a zone based firewall, multi vlan routing, NAT, and IPS). it seems to some times throuh up errors about fragmented frames and stuff. I knwo its a lot for one router to run but the network is very low usage (a few very lightly uterlised webservers < 500meg a month total, and a few PC's used sporadicaly to browse the internet) Its realy jsut proof of consept. what i want is the ethernet side to run using a MTU of 1490 (so it can be doubble tag with out affecting the 1514 limit of ethernet), Do i need to do any more than change the MTU size on the ethernet interface that is running the routing. will all devices then use this MTU when they try to reach the DFGW/router? Thank you Aaron ... View more

I want to know the best way to asssign public ip adddress for nat. My isp has given me a small block of IP addresses. (34.56.12.0 / 255.255.255.252) which i want to assign to be used in NAT on my network. the WAN ip address assigened by my ISP is 81.24.64.35 and so assigend to the dialer interface on the router. (sicso 1841 with adsl wic) what is the best way to set up the 34.56.12.0 addresses on the router so I can use them in static nat translations to web servers. I was thinking of assigning them to a loopback interface. but what i want is for out going connnections (A internal network of broadband pc's) to talk out using the WAN IP address then the 34.56.12.0 addresses used for incomming connections from out side to our webservers. my problem is that I need the intrenal PC to be able to connect to the webserver via there external address. (so i kind of U turn through the router/firewall) and i cant get this to work. At the moment I using inside and outside nat interfaces I was wondering I should be using the virtual interface and nat enababled interfaces. cheers ... View more

Hi, I have a singel network with teh only routing carried out by 2 4506 switchs. the main paort of this network is using the 192.168.0.0 / 16 subnet (further subnetted) one of the ports on the 4506 is set up as a routed port and connected to the 172.16.10.0 255.255.255.0 network (a server Drac managemtn ment card network) What i need to set up, is a way to restrict any one from access to this 172.16.10.0 network, apart from one or two indivuals. However they may need to accees this network from any of the devices connected to the 192.168.0.0 network range. so it need to be a way where when a user tries to access the network it authenticeas on the fly. My first idea was to set up lock and key, however I keep getting a access group not assigned to vlan 1 error? I was wonderign if there is a way using the current 4506's along with a radius server to authenticate access to that one network based on the OU some one is in, in AD. Now I know with a full on router this would be a lot simpler, but can any one tell me how you go about setting up this kind of dynamic access control to a network. Thank you If you would like a digram please let me know ... View more

Hi, I have a 1841 that I am trying to get the ADSL link to come up on. My ATM interface is showing as Down Down. Running a debug atm events shows open failed: Protocol error recived -- retrying? I have updated the ios to 12.4(24)T1 and before this, the card was working. Could this be a firmware mismatch error, and if so how can i go about seeing what firmware version the ADSL-WIC card is running and upgrading it if nessery? Cheers Aaron ... View more