Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About sundar.palaniappan
08-18-2017
Stats
Member since
04-25-2005
2076
Posts
1899
Helpful
230
Solutions
08-12-2008
09:01 AM
248 indicates the first 5 bits of the 3rd octet need to match but it doesn't care about the last 3 bits (address range of 0-7). A quick search on Netpro should find lot of useful links on subnetting. Here's one I found on google that may find helpful. http://www.timothytuohy.com/subnetting_101.htm HTH Sundar
... View more
08-12-2008
06:31 AM
Chuck To enter a range of addresses you can use the appropriate network mask to keep the number of network objects required to a minimum. In your scenario this can be done with 3 network objects rather than 10 host network objects like this. object-group network TEST network-object 12.12.12.0 255.255.255.248 network-object 12.12.12.8 255.255.255.254 network-object host 12.12.12.10 HTH Sundar
... View more
08-02-2008
01:52 PM
Can you provide the following output from all 3 switches? show int trunk show vlan show vtp status
... View more
08-02-2008
01:46 PM
Sure, duplex mismatch can cause the interface to go into an error disable state. quoting from CCO: ""Duplex mismatch Duplex mismatches are common because of failures to autonegotiate speed and duplex properly. Unlike a half duplex device, which must wait until there are no other devices that transmit on the same LAN segment, a full-duplex device transmits whenever the device has something to send, regardless of other devices. If this transmission occurs while the half-duplex device transmits, the half-duplex device considers this either a collision (during the slot time) or a late collision (after the slot time). Because the full-duplex side never expects collisions, this side never realizes that it must retransmit that dropped packet. A low percentage rate of collisions is normal with half duplex but is not normal with full duplex. A switch port that receives many late collisions usually indicates a duplex mismatch problem. Be sure that the ports on both sides of the cable are set to the same speed and duplex. The show interfaces interface_number command tells you the speed and duplex for Catalyst switch ports. Later versions of Cisco Discovery Protocol (CDP) can warn you about a duplex mismatch before the port is put in the error-disabled state."" http://www.cisco.com/en/US/tech/tk389/tk621/technologies_tech_note09186a00806cd87b.shtml HTH Sundar
... View more
08-02-2008
01:24 PM
Does VLAN 50 show as active in the 'show vlan' output? Is VLAN 50 allowed on the trunk port on the other switch? What model switch is this? Some of the low end catalyst switches have a limitation on how many VLANs they can support.
... View more
Created by
sundar.palaniap
in Firewalls
in Firewalls
07-28-2008
06:11 PM
07-28-2008
06:11 PM
Add the command 'same-security-traffic permit intra-interface' to route traffic in and out of the same interface. http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a0080734db7.shtml HTH Sundar
... View more
07-28-2008
05:46 PM
Once the traffic makes it to your router it needs to know how to get to that network internally. If all you have is the 2821 then as you said you can either use it as a secondary address on an interface, use the address range on a different interface or use it for NAT (global address range) of internal hosts. The benefit with NAT is you don't have to readdress the LAN hosts and the addition of new address range would be transparent to the hosts. HTH Sundar
... View more
07-28-2008
05:04 PM
Marko Expanding on this example of Load Sharing When Multihomed to Two ISPs Through Multiple Local Routers http://www.cisco.com/en/US/tech/tk365/technologies_configuration_example09186a00800945bf.shtml#conf5 Yes you can run IBGP on all three routers to create a full mesh. No need to worry about the peers having to be directly connected as multihop peering is supported in IBGP by default. However, this example only gives you a baseline understanding of how load sharing can be done in a situation like yours and the specifics or configuration required have to be worked out carefully as you don't want your AS to become a transit AS or result in suboptimal routing etc. HTH Sundar
... View more
07-28-2008
04:18 PM
Marko Any recommendation would depend on how you would like to route traffic from the core out to the Internet. Do you want to load balance the traffic out both ISPs or use one as primary and the other one as backup connection? Since both ISPs are advertising the full routing table redistributing all BGP routes into OSPF would help the CORE device choose the optimal path to get to any network on the Internet. However, the downside would be your CORE router would need lot of memory and processing power to make use of this option. On the other hand if you want to use the ISP links as primary and backup then just configure the two border routers to advertise just the default route to your CORE. You can tweak the metric (cost) in OSPF to influence the route selection from the CORE perspective. You might be able to use a nice OSPF feature 'conditional default origination' in the backup border router to only inject a default route into the CORE only when the tracked WAN IP of the primary border router becomes unreachable. Here's a link that you may find useful. http://www.cisco.com/en/US/tech/tk365/technologies_configuration_example09186a00800945bf.shtml HTH Sundar
... View more
Created by
sundar.palaniap
in Firewalls
07-28-2008
02:51 PM
07-28-2008
02:51 PM
Mike PIX/ASA does not support telnet on outside interface. You can access it via SSH from the outside. Have a look at this link for SSH setup. http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a008069bf1b.shtml#configs HTH Sundar
... View more
Created by
sundar.palaniap
in VPN and AnyConnect
07-26-2008
06:32 PM
07-26-2008
06:32 PM
MS Failover configuration looks good on both units. As you correctly pointed out the only configuration that's required on the standby unit is the failover configuration. Verify VLAN 1 and 2 interfaces are showing as monitored interfaces and the status should be normal in the 'show failover' output. HTH Sundar
... View more
07-22-2008
02:36 PM
Mike Just wanted to make sure you are pinging from inside to outside, right? If you are then the following configuration that you have in there now should allow ICMP echo-reply packets to come through. policy-map global_policy class inspection_defaul inspect icmp Though this is the legacy way of doing it you can try this configuration and that should work. access-list OUTSIDE permit icmp any any echo-reply access-group OUTSIDE in interface outside HTH Sundar
... View more
07-22-2008
01:45 PM
"threat-detection basic-threat" I haven't worked with this command before. Can you remove this command and check.
... View more
07-22-2008
01:14 PM
ICMP traffic isn't inspected by default. Did you add the configuration 'fixup protocol icmp'? If still doesn't work can you post a sanitized copy of the ASA configuration.
... View more
07-22-2008
12:53 PM
Mike, Try this configuration and test your ping from inside to outside. nat (inside) 1 10.x.180.0 255.255.255.128 --> This is your inside network. global (outside) 1 interface fixup protocol icmp Let us know if this helps. HTH Sundar
... View more
08-12-2008
248 indicates the first 5 bits of the 3rd octet need to match but it
doesn't care about the last 3 b...
08-12-2008
ChuckTo enter a range of addresses you can use the appropriate network
mask to keep the number of ne...
08-02-2008
Can you provide the following output from all 3 switches?show int
trunkshow vlanshow vtp status
08-02-2008
Sure, duplex mismatch can cause the interface to go into an error
disable state. quoting from CCO:""...
08-02-2008
Does VLAN 50 show as active in the 'show vlan' output?Is VLAN 50 allowed
on the trunk port on the ot...
07-28-2008
Add the command 'same-security-traffic permit intra-interface' to route
traffic in and out of the sa...
07-28-2008
Once the traffic makes it to your router it needs to know how to get to
that network internally. If ...
07-28-2008
MarkoExpanding on this example of Load Sharing When Multihomed to Two
ISPs Through Multiple Local
Ro...
07-28-2008
MarkoAny recommendation would depend on how you would like to route
traffic from the core out to the...
07-28-2008
MikePIX/ASA does not support telnet on outside interface. You can access
it via SSH from the outside...
Created by
sundar.palaniappan
in VPN and AnyConnect
07-26-2008
07-26-2008
MSFailover configuration looks good on both units. As you correctly
pointed out the only configurati...
07-22-2008
MikeJust wanted to make sure you are pinging from inside to outside,
right?If you are then the follo...
07-22-2008
"threat-detection basic-threat" I haven't worked with this command
before. Can you remove this comma...
07-22-2008
ICMP traffic isn't inspected by default.Did you add the configuration
'fixup protocol icmp'?If still...
Public Statistics
| Date Registered | 04-25-2005 03:58 PM |
| Date Last Visited | 08-18-2017 03:53 AM |
| Total Messages Posted | 2,076 |
| Total Helpful Votes Received | 1899 |
Helpful Votes Given To
.jpg "Hall of Fame Cisco Employee"){kind=icon}
Helpful Votes From
