About krishnadas.R_2

krishnadas.R_2 · ‎06-17-2014

With "mls qos" OFF the switch does not modify any markings. - With "mls qos" ON the switch clears all COS, ip-prec, and DCSP, unless the trust configuration was specified.

krishnadas.R_2 · ‎04-30-2014

N7Ks are used at single customer site. D1&D2 are collapsed core-dist switches (vdc), where access switches will connect and S1&S2 are server farm vdcs where fex's are attached. 7k1 7k2 S1------S2 D1------D2

krishnadas.R_2 · ‎04-30-2014

Hi I have 2 N7Ks N7K-1 have 2 VDCs, D1 and D2 N7K-2 have 2 VDCc S1 and S2 D1&D2 have vPC configured between them and S1&S2 also have vPCs b/w them. What is the best practice to interconnect D1&D2 to S1&S2 with redundancy ? I am yet to see a Cisco Doc that discusses this design, Please let me know your suggestions. TIA.

krishnadas.R_2 · ‎04-17-2011

Hi Daniel, I will give A2.3.3 a try in coming days and shall update the results. Many thanks for the advice. Regards, Kris

krishnadas.R_2 · ‎04-14-2011

Hi All, We have a two ACE module running in a redentant setup in CAT-6500. The software version is Version A2(1.6a) [build 3.0(0)A2(1.6a) It has started giving many issues lately, promtping us to think of a software upgrade. Please advice, which version is most stable in your experaince ? Thanks in advance. Kris

krishnadas.R_2 · ‎06-29-2010

Hi, It is working now, adding port 80 fixed the issue. Many Thanks. 5/5

krishnadas.R_2 · ‎06-28-2010

Hi, The context was configured for Load Balancing Port 80 and 443 traffic before the SSL Configs was Applied. The SSL Termination is configured on ACE module running the software version A2(1.6a) [build 3.0(0)A2(1.6a) The load balacing is working without no issues, But when i do a https://abc.www.abc.qa/wps/portal/login the browser reconganizes the certificate from ACE, but does not show up any thing, just shows this symbol € in a blank page. Plese let me know if you have any suggestions. Thanks in Advance. Here is the relevant config. =================== crypto csr-params ABC-II-PRAMS country XX state XXXX locality XXXX organization-name abc council common-name abc.www.abc.qa serial-number 1 email abc@abc.com rserver host abcserver1 ip address 10.14.1.165 inservice rserver host abcserver2 ip address 10.14.1.177 inservice ssl-proxy service abc.www.proxy key abc-II-key.pem cert abc-II-cert.pem serverfarm host abc.www.abc.qa-443 failaction purge rserver abcserver1 probe abcicmp inservice rserver abcserver2 probe abcicmp inservice serverfarm host abc.www.abc.qa-80 failaction purge rserver abcserver1 probe abcicmp inservice rserver abcserver2 probe abcicmp inservice sticky ip-netmask 255.255.255.255 address source abc.www.abc.qa-sticky-80 timeout 120 serverfarm abc.www.abc.qa-80 sticky ip-netmask 255.255.255.255 address source abc.www.abc.qa-sticky-443 timeout 120 serverfarm abc.www.abc.qa-443 ! ! class-map match-all abc.www.abc.qa-443 match virtual-address 10.14.1.203 tcp eq https ! class-map match-all abc.www.abc.qa-80 match virtual-address 10.14.1.203 tcp eq www ! ! policy-map type loadbalance first-match abc.www.abc.qa-VIP-443 class class-default sticky-serverfarm abc.www.abc.qa-sticky-443 ! policy-map type loadbalance first-match abc.www.abc.qa-VIP-80 class class-default sticky-serverfarm abc.www.abc.qa-sticky-80 policy-map multi-match abc-POLICY class abc.www.abc.qa-80 loadbalance vip inservice loadbalance policy abc.www.abc.qa-VIP-80 loadbalance vip icmp-reply class abc.www.abc.qa-443 loadbalance vip inservice loadbalance policy abc.www.abc.qa-VIP-443 loadbalance vip icmp-reply ssl-proxy server abc.www.proxy =============================

krishnadas.R_2 · ‎12-26-2009

Ks, I am waiting for the client to be avaliable to do the test, shall let you know the results. Thanks Kris

krishnadas.R_2 · ‎12-26-2009

Jon, FWSM is running code 3.1(4). Multicast routing is setup on the FWSM. kris

krishnadas.R_2 · ‎12-24-2009

Hi Jon, I was getting this error continously in the FWSM logs, Dec 23 2009 12:41:18: %FWSM-3-106010: Deny inbound udp src er-dmz-int:10.1.151.5/60812 dst er-db-zone:228.10.10.10/45566 Dec 23 2009 12:41:18: %FWSM-3-106010: Deny inbound udp src er-dmz-int:10.1.151.5/60812 dst er-db-zone:228.10.10.10/45566 Dec 23 2009 12:41:18: %FWSM-3-106010: Deny inbound udp src er-dmz-int:10.1.151.5/60812 dst er-db-zone:228.10.10.10/45566 Dec 23 2009 12:41:18: %FWSM-3-106010: Deny inbound udp src er-dmz-int:10.1.151.5/60812 dst er-db-zone:228.10.10.10/45566 As per cisco doc, http://www.cisco.com/en/US/docs/security/fwsm/fwsm22/system/message/fsmemsgs.html %FWSM-3-106010 --> "This is a connection-related message. This message is logged if an inbound connection is denied by your security policy" There is a specific permit line in ACL that allows traffic to 228.10.10.10 from 10.1.151.0 and I saw hits aswell on those lines. I cleared the xlate for source and destination, removed and re-applied the ACL lines with no luck untill I lowered the security level. But the fact is that there are many other vlans working in similar fashion in this FWSM, only this couple of interface had issues. The traffic is multicast, but does that make a diffrence when connectivity is working one-way ? Thanks Kris

krishnadas.R_2 · ‎12-24-2009

er-db-zone = DB vlan er-dmz-int = APP vlan static (er-db-zone,er-dmz-int) 10.1.149.0 10.1.149.0 netmask 255.255.255.0 static (er-dmz-int,er-db-zone) 10.1.151.0 10.1.151.0 netmask 255.255.255.0

krishnadas.R_2 · ‎12-24-2009

Hi, I have two vlans defined on the FWSM, APP and DB, For the APP vlan, Sec level is 60 for DB it is 100. I wanted to allow multicast from APP to DB and Vice Versa. The necessary NAT statement and ACLs are updated and connectivity is working from DB to APP vlan. However though ACL and NAT statements are in place for APP -> DB communication, I had to lower security level of the DB vlan to 60 to make it work. As soon as I lowered the security level it started working. Is there a way to make it work without lowering the security level ? Thanks, Kris

krishnadas.R_2 · ‎12-14-2009

Hi, ASA wont allow port redirection, so you may need to use the DNS doctoring feature.. If accessing the server via the internal IP address meets your needs, then you may want to try DNS doctoring. hth http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00807968d1.shtml

krishnadas.R_2 · ‎12-14-2009

HI, We can assume that since you are getting the login prompt, connectivity and NAT is working. Check if the connection is getting redirected to a diffrent port after you enter the login credentials.

krishnadas.R_2 · ‎12-13-2009

Hi, I am trying to make the Multicast working between two vlans defined in FWSM.. Hosts are running mysql cluster and Multicast is used to send master/slave status information to the IP 228.10.10.10 on port 45566. The vlan is defined in FWSM and the host are connected via the core-switch(6513). (hosts-->core-sws--->fwsm).. FWSM is running code 3.1(4). I have enabled <multicast-routing> in FWSM. Just wondering if this is enough to make it working ? Any advice is higly appreciated. Thanks in Advance. kris

Date Registered	‎04-07-2006 10:52 AM
Date Last Visited	‎08-18-2017 03:53 AM
Total Messages Posted	25
Total Helpful Votes Received	5

With "mls qos" OFF the

N7Ks are used at single

N7k Interconnection between Multiple V...

Re: ACE Module Software Upgrade

ACE Module Software Upgrade

Re: SSL Termination not working in ACE

SSL Termination not working in ACE

Re: Query - FWSM Security Levels..

Re: Query - FWSM Security Levels..

Re: Query - FWSM Security Levels..

Re: Query - FWSM Security Levels..

Query - FWSM Security Levels..

Re: NAT help

Re: ASA 5510 and web camera access

Inter Vlan Multicast in FWSM.