Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About DaeHeon Kang
Stats
Member since
05-10-2010
37
Posts
0
Helpful
0
Solutions
Created by
DaeHeon Kang
in Switching
in Switching
02-18-2019
03:01 PM
02-18-2019
03:01 PM
Hi
I've set Stackwise Virtual with different priority value(each 15 and 14) for aiming to keep one switch always-be active.
The switch that I set priority 15 didn't become active when I later turned it on after first booting the switch with priority 14
as the below show output.
I expected the switch that has 15 priority should be active switch regardless the order of booting.
What could cause this? And additionally, is there any command for changing over active/standby swith?
==========================================================
AAA#show switch Switch/Stack Mac Address : 0cd0.f83b.7e00 - Local Mac Address Mac persistency wait time: Indefinite H/W Current Switch# Role Mac Address Priority Version State ------------------------------------------------------------------------------------- 1 Standby 0cd0.f83b.5300 15 V01 Ready *2 Active 0cd0.f83b.7e00 14 V01 Ready
... View more
- Tags:
- stackwise virtual
Labels:
Created by
DaeHeon Kang
in Other Security Subjects
in Other Security Subjects
10-04-2018
06:49 PM
10-04-2018
06:49 PM
Hi
I am seeking the reason why switch enabled with DHCP snooping inserts option 82 to DHCP packet before transfer to
DHCP server or DHCP relay.
Is there any specific reason or which case is it for?
... View more
Labels:
09-06-2018
03:55 PM
Sorry this problems has been solved by put ospf netwok type point to point on the link between R2-R3. And this is the production network which is hard to try to make the duplicate issue.
it’s really weird m. I haven’t seen this kind of thing before. Even I was considering about ios bug..
... View more
09-06-2018
03:51 PM
This is not about ospf network type under loobpback interfaces. There are no any command ospf network type point to point on the all looback interfaces.
... View more
09-06-2018
03:47 PM
There are no any ospf point to point network type command under all router’s loopback interfaces. All routers show /32 for each loopback address. This problem seems narrowing down about the ospf network type between R2-R3 as it was solved or happened depend on the network type of the link.
... View more
09-06-2018
03:39 PM
All routers are in thw same area 0 and all routers including R4 show loopback addresses of each router as router link state on OSPF database. The weird thing is only R4 doesn’t show R1 and R2 loopback addrsses on the routing table.
... View more
09-06-2018
03:36 PM
The ospf broadcast type is only the link betwwen R2-R3 as there is no any ospf network type configuration.
And also there are no ip ospf network type point to point command under all loopback interfaces.
... View more
09-06-2018
03:53 AM
I have been looking for the reason why R4 doesn't show R1 and R2 loopback IP addresses on the routing table. The R1 & R2 loopback IP addresses are seen on the OSPF datebase as Router Link State on the R4.
However, It shows it's unreachable when checked those loopback IP addresses by command, show ip ospf datebase router 1.1.1.1 or 2.2.2.2. Interestingly, The problem was solved when I changed the OSPF network type between R2 and R3 from broadcast to point to point.
... View more
Labels:
08-21-2018
10:01 PM
Hi
I am seeking for the reason why the state from one of two DMVPN tunnels of SPOKE is stuck in IKE, however the relevant HUB shows the state regarding the SPOKE as UP.
The output from show commands is as below;
SPOKE1#show dmvpn Legend: Attrb --> S - Static, D - Dynamic, I - Incomplete N - NATed, L - Local, X - No Socket # Ent --> Number of NHRP entries with same NBMA peer NHS Status: E --> Expecting Replies, R --> Responding UpDn Time --> Up or Down Time for a Tunnel ==========================================================================
Interface: Tunnel50, IPv4 NHRP Details <-- DMVPN tunnel to HUB2 through PPPoE network Type:Spoke, NHRP Peers:1,
# Ent Peer NBMA Addr Peer Tunnel Add State UpDn Tm Attrb ----- --------------- --------------- ----- -------- ----- 1 10.220.251.145 10.220.143.1 IKE 05:14:57 S
Interface: Tunnel60, IPv4 NHRP Details <-- DMVPN tunnel through MPLS network Type:Spoke, NHRP Peers:1,
# Ent Peer NBMA Addr Peer Tunnel Add State UpDn Tm Attrb ----- --------------- --------------- ----- -------- ----- 1 10.220.147.1 10.220.148.1 UP 4d18h S
HUB2#show dmvpn Legend: Attrb --> S - Static, D - Dynamic, I - Incomplete N - NATed, L - Local, X - No Socket # Ent --> Number of NHRP entries with same NBMA peer NHS Status: E --> Expecting Replies, R --> Responding UpDn Time --> Up or Down Time for a Tunnel ==========================================================================
Interface: Tunnel100, IPv4 NHRP Details Type:Hub, NHRP Peers:13,
# Ent Peer NBMA Addr Peer Tunnel Add State UpDn Tm Attrb ----- --------------- --------------- ----- -------- ----- 1 10.220.251.170 10.220.143.9 UP 05:18:20 D
... View more
- Tags:
- dmvpn
Labels:
Created by
DaeHeon Kang
in VPN and AnyConnect
in VPN and AnyConnect
12-19-2017
07:41 PM
12-19-2017
07:41 PM
How is different between the below ways for GRE over IPSec? and how is the structure of the frame different between the two ways? And also which ways is the recommend way to deploy GRE over IPSec?
Apply Crypto map to physical interface by using access-list 100 permit gre host [ interface ip address] host [interface ip address]
Apply tunnel protection ipsec profile to tunnel interface
... View more
Labels:
11-16-2017
07:13 PM
I have been testing EasyVPN combined with IPSec VPN and there is an issue regarding the communication on VPN Tunnels which is summarized as follow: * attach the configuration from Office Router and Diagram
The communication through IPSec Tunnel is fine.
EasyVPN connection can be done.
EasyVPN client can't communicate with hosts within Internal Network after EasyVPN connection.
Only ping to Office Router is fine from EasyVPN client.
SSH or Telnet to Office Router is fine from EasyVPN client only if there is not Nat command under interfaces of Office Router.
!
!
aaa new-model
!
!
aaa authentication login EZ-AAA local
aaa authorization network EZ-AAA local
!
!
username cisco privilege 15 password 0 cisco
!
!
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 5
crypto isakmp key NETWORK address 1.1.1.1
!
crypto isakmp policy 3
encr 3des
hash md5
authentication pre-share
group 2
!
crypto isakmp client configuration group EZ-GROUP
key cisco123
pool EZ-POOL
acl 199
!
!
crypto ipsec transform-set 3DES-SHA esp-3des esp-sha-hmac
!
crypto ipsec transform-set ESP esp-aes 256 esp-sha-hmac
mode tunnel
!
crypto dynamic-map DYNAMIC-MAP 1
set transform-set 3DES-SHA
!
crypto map IPSEC 10 ipsec-isakmp
set peer 1.1.1.1
set security-association lifetime seconds 28800
set transform-set ESP
set pfs group2
match address VPN-TRAFFIC
!
crypto map IPSEC client authentication list EZ-AAA
crypto map IPSEC isakmp authorization list EZ-AAA
crypto map IPSEC client configuration address respond
crypto map IPSEC 20 ipsec-isakmp dynamic DYNAMIC-MAP
!
!
!
interface FastEthernet0/0
ip address 1.1.1.2 255.255.255.252
duplex auto
speed auto
crypto map IPSEC
ip nat outside
!
interface FastEthernet0/1
ip address 192.16.15.1 255.255.255.0
duplex auto
speed auto
ip nat inside
!
!
ip local pool EZ-POOL 172.16.1.2 172.16.1.254
ip route 0.0.0.0 0.0.0.0 1.1.1.1
!
!
ip http server
no ip http secure-server
!
ip access-list extended VPN-TRAFFIC
permit ip 192.168.15.0 0.0.0.255 10.1.1.0 0.0.0.255
permit ip 192.168.15.0 0.0.0.255 10.2.2.0 0.0.0.255
!
ip access-list exttended NAT
deny ip 172.16.1.0 0.0.0.255 any
permit ip 192.168.15.0 0.0.0.255 any
!
access-list 199 permit ip 192.168.15.0 0.0.0.255 any
!
ip nat inside source list NAT interface fa0/0 overload
!
!
!
... View more
Labels:
11-02-2017
07:12 PM
I configured it ( vPC domain -> vPC keepalive link -> vPC peer link -> vPC).
Anyway, I will try to configure as you mention.
... View more
11-02-2017
07:03 PM
It appears the keep-alive with VRF is fine as the following command output. Is there any thing to cause this problem regarding VRF?
NX9K_1# show vpc peer-keepalive
vPC keep-alive status : peer is alive --Peer is alive for : (10363) seconds, (372) msec --Send status : Success --Last send at : 2017.11.03 02:01:24 864 ms --Sent on interface : Eth1/1 --Receive status : Success --Last receive at : 2017.11.03 02:01:24 867 ms --Received on interface : Eth1/1 --Last update from peer : (0) seconds, (957) msec
vPC Keep-alive parameters --Destination : 10.1.1.2 --Keepalive interval : 1000 msec --Keepalive timeout : 5 seconds --Keepalive hold timeout : 3 seconds --Keepalive vrf : vpc --Keepalive udp port : 3200 --Keepalive tos : 192
... View more
11-02-2017
06:36 PM
The followings are the output from "show run"
NX9K_1# show run
!Command: show running-config !Time: Fri Nov 3 01:33:51 2017
version 7.0(3)I5(1) power redundancy-mode combined force
hostname NX9K_1 vdc NX9K_1 id 1 limit-resource vlan minimum 16 maximum 4094 limit-resource vrf minimum 2 maximum 4096 limit-resource port-channel minimum 0 maximum 511 limit-resource u4route-mem minimum 248 maximum 248 limit-resource u6route-mem minimum 96 maximum 96 limit-resource m4route-mem minimum 58 maximum 58 limit-resource m6route-mem minimum 8 maximum 8
cfs eth distribute feature lacp feature vpc
username admin password 5 $5$KgXKlfjC$JHebppf4aQMhD4lCixTP8XAdPlEMp5nPdixbqUvr65 4 role network-admin ip domain-lookup snmp-server user admin network-admin auth md5 0xa029b397099702ec108eed698125288d priv 0xa029b397099702ec108eed698125288d localizedkey rmon event 1 description FATAL(1) owner PMON@FATAL rmon event 2 description CRITICAL(2) owner PMON@CRITICAL rmon event 3 description ERROR(3) owner PMON@ERROR rmon event 4 description WARNING(4) owner PMON@WARNING rmon event 5 description INFORMATION(5) owner PMON@INFO
vlan 1
vrf context management vrf context vpc vpc domain 100 peer-keepalive destination 10.1.1.2 source 10.1.1.1 vrf vpc
interface port-channel1 switchport mode trunk spanning-tree port type network vpc peer-link
interface port-channel2 switchport mode trunk vpc 2
interface Ethernet1/1 no switchport vrf member vpc ip address 10.1.1.1/30 no shutdown
interface Ethernet1/2 switchport mode trunk channel-group 1 mode active
interface Ethernet1/3 switchport mode trunk channel-group 1 mode active
interface Ethernet1/4 switchport mode trunk channel-group 2 mode active
interface Ethernet1/5
interface Ethernet1/6
interface Ethernet1/7
interface Ethernet1/8
interface Ethernet1/9
interface mgmt0 vrf member management line console line vty boot nxos bootflash:/nxos.7.0.3.I5.1.bin
NX9K_2# show run
!Command: show running-config !Time: Fri Nov 3 01:34:51 2017
version 7.0(3)I5(1) power redundancy-mode combined force
hostname NX9K_2 vdc NX9K_2 id 1 limit-resource vlan minimum 16 maximum 4094 limit-resource vrf minimum 2 maximum 4096 limit-resource port-channel minimum 0 maximum 511 limit-resource u4route-mem minimum 248 maximum 248 limit-resource u6route-mem minimum 96 maximum 96 limit-resource m4route-mem minimum 58 maximum 58 limit-resource m6route-mem minimum 8 maximum 8
cfs eth distribute feature lacp feature vpc
username admin password 5 $5$0jE4t.7T$6MPYE4.IaQp.jpK2Ai2QxHUiRJ87ybos2JyAgQB4U1 0 role network-admin ip domain-lookup snmp-server user admin network-admin auth md5 0xd00e889e95429ac0d902a738b3796d1d priv 0xd00e889e95429ac0d902a738b3796d1d localizedkey rmon event 1 description FATAL(1) owner PMON@FATAL rmon event 2 description CRITICAL(2) owner PMON@CRITICAL rmon event 3 description ERROR(3) owner PMON@ERROR rmon event 4 description WARNING(4) owner PMON@WARNING rmon event 5 description INFORMATION(5) owner PMON@INFO
vlan 1
vrf context management vrf context vpc vpc domain 100 peer-keepalive destination 10.1.1.1 source 10.1.1.2 vrf vpc
interface port-channel1 switchport mode trunk spanning-tree port type network vpc peer-link
interface port-channel2 switchport mode trunk vpc 2
interface Ethernet1/1 no switchport vrf member vpc ip address 10.1.1.2/30 no shutdown
interface Ethernet1/2 switchport mode trunk channel-group 1 mode active
interface Ethernet1/3 switchport mode trunk channel-group 1 mode active
interface Ethernet1/4 switchport mode trunk channel-group 2 mode active
interface Ethernet1/5
interface Ethernet1/6
interface Ethernet1/7
interface Ethernet1/8
interface Ethernet1/9
interface mgmt0 vrf member management line console line vty boot nxos bootflash:/nxos.7.0.3.I5.1.bin
Switch#show run Building configuration...
Current configuration : 1018 bytes ! ! Last configuration change at 01:14:37 EET Fri Nov 3 2017 ! version 15.1 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption service compress-config ! hostname Switch ! boot-start-marker boot-end-marker ! ! ! no aaa new-model clock timezone EET 2 0 ! ip cef ! ! no ipv6 cef ipv6 multicast rpf use-bgp ! ! ! ! ! ! ! spanning-tree mode pvst spanning-tree extend system-id ! ! ! ! vlan internal allocation policy ascending ! ! ! ! ! ! ! ! ! ! interface Port-channel2 switchport switchport trunk encapsulation dot1q switchport mode trunk ! interface Ethernet0/0 switchport trunk encapsulation dot1q switchport mode trunk channel-group 2 mode active ! interface Ethernet0/1 switchport trunk encapsulation dot1q switchport mode trunk channel-group 2 mode active ! interface Ethernet0/2 duplex auto ! interface Ethernet0/3 duplex auto ! ! no ip http server ! ! ! ! ! control-plane ! ! line con 0 logging synchronous line aux 0 line vty 0 4 login ! end
... View more
Created by
DaeHeon Kang
in SD-WAN
10-09-2019
10-09-2019
HiI am trying to upgrade virtual image(UTD) with ISR1111X-8P by SD-WAN
vmanage.But it fails with the...
Created by
DaeHeon Kang
in SD-WAN
09-16-2019
09-16-2019
I don't have any visibility application & TCP optimization monitor from
vmanage. How can I get the v...
09-08-2019
I am looking for the CLI or template configuration example about BGP
configuration on transport side...
Created by
DaeHeon Kang
in SD-WAN
08-12-2019
08-12-2019
I've got answer from SD-WAN architect in Cisco with this question.It's
not able to protect the encry...
Created by
DaeHeon Kang
in SD-WAN
08-01-2019
08-01-2019
Hi, I am wondering if it's possible to protect encrypted malware with
the latest SD-WAN security fea...
07-09-2019
Hi, I am wonding if color under vpn 0 has meaning on vmanage, vsmart and
vbond.The relevant document...
02-18-2019
Hi I've set Stackwise Virtual with different priority value(each 15 and
14) for aiming to keep one s...
11-14-2018
Hi I am wondering the reason why the physical port which has multi
sub-interfaces belongs to VPN0, b...
Created by
DaeHeon Kang
in SD-WAN
11-08-2018
11-08-2018
I missed the information the end of the document. Thank you, Elesani
Created by
DaeHeon Kang
in SD-WAN
11-07-2018
11-07-2018
That document is for upgrading IOS XE to SD-WAN image. I am looking for
any stuff about downgrading ...
Created by
DaeHeon Kang
in SD-WAN
11-07-2018
11-07-2018
Hello, I am wondering if the recent version of Cisco ISR SD-WAN image
support TCP optimization featu...
Created by
DaeHeon Kang
in SD-WAN
11-07-2018
11-07-2018
Hello, I am trying to find the procedure how to migrate SD-WAN image to
IOS XE with ISR 4K or 1K. Is...
10-04-2018
Hi I am seeking the reason why switch enabled with DHCP snooping inserts
option 82 to DHCP packet be...
Public Statistics
| Date Registered | 05-10-2010 06:19 PM |
| Date Last Visited | 10-10-2019 12:29 AM |
| Total Messages Posted | 37 |
Helpful Votes Given To
.jpg "VIP Expert"){kind=icon}
