turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About geoffwynn
02-17-2019
geoffwynn
Member since
11-30-2004
Beginner
02-12-2019
02:07 AM
Hello all, well, long story short, I was actually using the router in place of a layer 3 SF500 switch (set to layer 3 mode) and after plugging it back in today and testing, it works! I think it might have been a default gateway issue (on some other devices) so thanks everyone for their valuable help! Geoff
... View more
02-11-2019
03:10 AM
Hello, sure, good idea although 10.1.2.5 is a small PC on the other side of the room hence the switches in the middle but good idea.
... View more
02-11-2019
01:50 AM
Roger, will do, at home now but will inspect again in the morning. Thanks for the help I hope to get to the bottom of this! Geoff
... View more
02-10-2019
09:32 PM
Hello, thanks, same response from 3725 router. Here is a cut & paste: R1#ping Protocol [ip]: Target IP address: 10.1.2.5 Repeat count [5]: Datagram size [100]: Timeout in seconds [2]: Extended commands [n]: y Source address or interface: 10.1.2.20 Type of service [0]: Set DF bit in IP header? [no]: Validate reply data? [no]: Data pattern [0xABCD]: Loose, Strict, Record, Timestamp, Verbose[none]: Sweep range of sizes [n]: Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.1.2.5, timeout is 2 seconds: Packet sent with a source address of 10.1.2.20 ..... Success rate is 0 percent (0/5) R1#debug ip packet IP packet debugging is on R1#p *Mar 1 01:27:03.703: IP: s=10.1.2.5 (FastEthernet0/0.1), d=255.255.255.255, len 44, rcvd 2 R1#ping Protocol [ip]: Target IP address: 10 *Mar 1 01:27:06.703: IP: s=10.1.2.5 (FastEthernet0/0.1), d=255.255.255.255, len 44, rcvd 2 10.1.2.5 Repeat count [5]: Datagram size [100]: Timeout in seconds [2]: *Mar 1 01:27:09.727: IP: s=10.1.2.5 (FastEthernet0/0.1), d=255.255.255.255, len 44, rcvd 2 Extended commands [n]: y Source address or interface: 1 *Mar 1 01:27:12.715: IP: s=10.1.2.5 (FastEthernet0/0.1), d=255.255.255.255, len 44, rcvd 2 10.1.2.20 *Mar 1 01:27:15.739: IP: s=10.1.2.5 (FastEthernet0/0.1), d=255.255.255.255, len 44, rcvd 2 10.1.2.20 Type of service [0]: Set DF bit in IP header? [no]: Validate reply data? [no]: Data pattern [0xABCD]: Loose, Strict, Record, Timestamp, Verbose[none]: *Mar 1 01:27:18.751: IP: s=10.1.2.5 (FastEthernet0/0.1), d=255.255.255.255, len 44, rcvd 2 Sweep range of sizes [n]: Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.1.2.5, timeout is 2 seconds: Packet sent with a source address of 10.1.2.20 *Mar 1 01:27:21.503: IP: tableid=0, s=10.1.2.20 (local), d=10.1.2.5 (FastEthernet0/0.2), rou ted via RIB *Mar 1 01:27:21.503: IP: s=10.1.2.20 (local), d=10.1.2.5 (FastEthernet0/0.2), len 100, sendi ng *Mar 1 01:27:21.507: IP: s=10.1.2.20 (local), d=10.1.2.5 (FastEthernet0/0.2), len 100, encap sulation failed *Mar 1 01:27:21.759: IP: s=10.1.2.5 (FastEthernet0/0.1), d=255.255.255.255, len 44, rcvd 2. *Mar 1 01:27:22.671: IP: s=10.1.2.5 (FastEthernet0/0.1), d=8.8.8.8, len 65, unroutable *Mar 1 01:27:22.671: IP: tableid=0, s=10.1.1.20 (local), d=10.1.2.5 (FastEthernet0/0.2), rou ted via RIB *Mar 1 01:27:22.675: IP: s=10.1.1.20 (local), d=10.1.2.5 (FastEthernet0/0.2), len 56, sendin g *Mar 1 01:27:22.675: IP: s=10.1.1.20 (local), d=10.1.2.5 (FastEthernet0/0.2), len 56, encaps ulation failed
... View more
02-10-2019
08:32 PM
Hello, I have a Cisco 3725 router connected to a Cisco SF500 switch, also connected to a SF500 switch (trunked) When I try to ping 10.1.2.5 from the router, it fails. When I debug it stated: R1#debug ip packet IP packet debugging is on R1#ping 10.1.2. *Mar 1 00:24:21.927: IP: s=10.1.2.5 (FastEthernet0/0.1), d=255.255.255.255, len 44, rcvd 2 R1#ping 10.1.2.5 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.1.2.5, timeout is 2 seconds: *Mar 1 00:24:23.675: IP: tableid=0, s=10.1.2.20 (local), d=10.1.2.5 (FastEthernet0/0.2), routed via RIB *Mar 1 00:24:23.675: IP: s=10.1.2.20 (local), d=10.1.2.5 (FastEthernet0/0.2), len 100, sending *Mar 1 00:24:23.679: IP: s=10.1.2.20 (local), d=10.1.2.5 (FastEthernet0/0.2), len 100, encapsulation failed *Mar 1 00:24:23.707: IP: tableid=0, s=10.1.2.5 (FastEthernet0/0.1), d=10.1.2.20 (FastEthernet0/0.2), routed via RIB *Mar 1 00:24:23.707: IP: s=10.1.2.5 (FastEthernet0/0.1), d=10.1.2.20, len 60, rcvd 4 *Mar 1 00:24:23.711: IP: tableid=0, s=10.1.2.20 (local), d=10.1.2.5 (FastEthernet0/0.2), routed via RIB *Mar 1 00:24:23.711: IP: s=10.1.2.20 (local), d=10.1.2.5 (FastEthernet0/0.2), len 60, sending *Mar 1 00:24:23.711: IP: s=10.1.2.20 (local), d=10.1.2.5 (FastEthernet0/0.2), len 60, encapsulation failed. Encapsulation error, meaning it cannot find the associated MAC address of 10.1.2.5. The 3725 has dot1.q sub interfaces Here is 3725 config: R1#show run Building configuration... Current configuration : 1261 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname R1 ! boot-start-marker boot-end-marker ! no aaa new-model memory-size iomem 5 no ip icmp rate-limit unreachable ip cef ! no ip domain lookup ! multilink bundle-name authenticated ! ip tcp synwait-time 5 ! interface FastEthernet0/0 no ip address duplex auto speed auto ! interface FastEthernet0/0.1 encapsulation dot1Q 1 native ip address 10.1.1.20 255.255.255.0 ! interface FastEthernet0/0.2 encapsulation dot1Q 50 ip address 10.1.2.20 255.255.255.0 ! interface FastEthernet0/0.3 encapsulation dot1Q 10 ip address 192.168.1.1 255.255.255.0 ! interface FastEthernet0/0.4 encapsulation dot1Q 20 ip address 172.20.1.1 255.255.255.0 ! interface FastEthernet0/1 no ip address shutdown duplex auto speed auto ! ip forward-protocol nd ! no ip http server no ip http secure-server ! no cdp log mismatch duplex ! control-plane line con 0 exec-timeout 0 0 privilege level 15 logging synchronous line aux 0 exec-timeout 0 0 privilege level 15 logging synchronous line vty 0 4 login ! ! end I been trying to get this working for days, no luck! Thoughts?? Geoff
... View more
Labels:
06-13-2017
03:57 AM
Thanks Aditya. So, lets say I changed the interface security level to be 1 2 3 & 4. Would I need this command then? No, it would not work and the ACL's would work as expected correct?
... View more
06-13-2017
02:43 AM
Hello, I am having trouble configuring a firewall at work. It is a Cisco ASA 5520 running 8.2. I cannot paste the config as it's in a secure environment. So, basically the config is:
interface gig 0/0
nameif prod
ip add 192.168.1.1 255.255.255.240
security level 85
!
interface gig 1/1
nameif prod1
ip add 192.168.1.17 255.255.255.240
security level 85
!
interface gig 1/2
nameif exercise
ip add 192.168.1.33 255.255.255.240
security level 75
interface gig 1/3
nameif exercise1
ip add 192.168.1.49 255.255.255.240
security level 75
access-list acl_out extended permit ip any any log 5
access-list acl_in extended permit ip any any log 5
!
interface gig 0/0
access-group acl_out out interface prod
access-group acl_out in interface prod
!
interface gig 1/1
access-group acl_out out interface prod
access-group acl_out in interface prod
!
interface gig 1/2
access-group acl_out out interface prod
access-group acl_out in interface prod
!
interface gig 1/3
access-group acl_out out interface prod
access-group acl_out in interface prod
That's pretty much it. The routes are all connected so I don't actually having routing statements.
I notice I cannot connect from a host on the outside of the interface to another host etc. It just will not work.
IF I add the command
same-security-traffic permit inter-interface
then it works. It even works IF I take out the access lists. This confuses me. I essentially want prod to talk to prod1 and vica-versa, and exercise to talk to exercise1 etc, and also out to an external connection, which I will set up a route for.
If I use this command "same-security-traffic intra-interface" do I also use ACL'S? How do I do it without this command? Change the security levels to be all different? This command seems to override the need for ACL's. So do I use this command and THEN apply ACL's to permit/deny as appropriate?
Can anyone please assist me with this as it has been driving me nuts!
Thanks,
Geoff
... View more
Labels:
09-18-2014
09:55 PM
Thanks Nagendra, I'll give this a try and report back the results. Many thanks for your help, Geoff
... View more
08-26-2014
10:35 PM
Hello, I have a switch with some VM's hanging off of it. I want to isolate VLAN 888 which is to be used for malware, so I therefore want it isolated BUT I want it to be able to access the Internet to download malware etc. I have set-up VRF on interface VLAN888 and given it an IP address, 20.0.0.1 I just want hosts on 20.0.0.x to be able to get to the internet, download malware, surf the net, etc. I do not want this subnet talking to anything but the gateway. I am trying to limit my exposure from malware (I am doing malware analysis) I have several other vlans which I have taken out of this config for this post. If I don't use the GLOBAL keyword at the end of the ip route vrf red 0.0.0.0 0.0.0.0 10.10.10.1 global command than it will simply not work at all However, it IS "working" configured like this but I can ping other subnets within the switch. I would of thought, without the global command that this would have worked and everything is sweet and that vrf red would know about the gateway. The gateway also has a route pointing back to 20.0.0.0 255.0.0.0 10.10.10.2 Is this correct? not correct? Any tips? Thanks - Geoff Config below>> ****************************************************************************************** CYBDKNSW001# show ip route vrf red Routing Table: red Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 ia - IS-IS inter area, * - candidate default, U - per-user static route o - ODR, P - periodic downloaded static route Gateway of last resort is 10.10.10.1 to network 0.0.0.0 C 20.0.0.0/8 is directly connected, Vlan888 S* 0.0.0.0/0 [1/0] via 10.10.10.1 ************************************************************************************************ ip routing no ip domain-lookup ! ! ip vrf red rd 45:1 ! interface Vlan500 ip address 192.168.6.1 255.255.255.0 ip helper-address 192.168.3.19 ip accounting output-packets ip accounting access-violations ! ! interface Vlan800 description Firewall-Gateway_VLAN ip address 10.10.10.2 255.255.255.252 ! interface Vlan888 description MALWARE ip vrf forwarding red ip address 20.0.0.1 255.0.0.0 ! ip classless ip route 0.0.0.0 0.0.0.0 10.10.10.1 (gateway to internet) ip route 20.0.0.0 255.0.0.0 Vlan888 ip route vrf red 0.0.0.0 0.0.0.0 10.10.10.1 global
... View more
Labels:
a week ago
Hello all, well, long story short, I was actually using the router in
placeof a layer 3 SF500 switch...
a week ago
Hello, sure, good idea although 10.1.2.5 is a small PC on the other side
ofthe room hence the switch...
a week ago
Roger, will do, at home now but will inspect again in the morning.
Thanksfor the help I hope to get ...
a week ago
Hello, thanks, same response from 3725 router. Here is a cut &
paste:R1#pingProtocol [ip]:Target IP ...
a week ago
Hello, I have a Cisco 3725 router connected to a Cisco SF500 switch,
also connected to a SF500 switc...
06-13-2017 03:57 AM
Thanks Aditya. So, lets say I changed the interface security level to be
1 2 3 & 4. Would I need thi...
09-18-2014 09:55 PM
Thanks Nagendra, I'll give this a try and report back the results. Many
thanks for your help, Geoff
Public Statistics
| Date Registered | 11-30-2004 02:11 PM |
| Date Last Visited | 02-17-2019 09:39 PM |
| Total Messages Posted | 9 |
.jpg "Hall of Fame Master"){kind=icon}
