Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About noc
Stats
Member since
12-08-2000
71
Posts
9
Helpful
0
Solutions
Created by
noc
in Security Management
in Security Management
07-15-2005
05:20 AM
07-15-2005
05:20 AM
Wrong pinout... the vpn 3005 does not use null modem cables... its a straight cat 5 cable! so, just connect a cat 5 between the terminal adapters!
... View more
Created by
noc
in VPN and AnyConnect
in VPN and AnyConnect
06-17-2005
07:23 AM
06-17-2005
07:23 AM
the VPN 3000 series login to active directory (kerberos) really doesn't work. It has never worked on my production ad domains, just my test domain. its not very easy to figure out what is going on. I think Cisco dropped the ball on this, why isn't there any good documentation on their site about 3000 to ad login ? I found a workaround - use NT DOMAIN with your ad domain controllers, it will use NTLM as the authentication method... this works even with "native" ms ad domains... FYI
... View more
Created by
noc
in VPN and AnyConnect
in VPN and AnyConnect
04-15-2005
05:52 AM
04-15-2005
05:52 AM
Just so you don't go crazy; I tried here with "kerberos" and for 3 months could not get it working... I think the reason was that if the AD domain controller is no a forrest root domain controller it somehow messes up the REALM for the ad forrest and can't take this kind of kerberos ticket request... Man we spent like 4 saturdays trying to get this to work... Finally went with "NT DOMAIN" which works fine, you can also disable group lookup, so your users can type the full ad login user123@somecompany.com and use just 1 password for everything. If anyone can solve the Kerberos enigma with 3000's please tell us !
... View more
04-11-2005
02:22 PM
Guys and Gals, I need to allow a level 9 user in my switches the ability to manage interfaces f0/1 to f0/44 but NOT interfaces f0/45 thru interface f0/48 (these are trunks). Any Idea why this does not work... privilege interface level 8 switchport port-security max privilege interface level 8 switchport port-security mac stick privilege configure level 15 interface f0/45 privilege configure level 8 interface f0/8 privilege exec level 8 config t privilege exec level 6 show interface privilege exec level 6 show run thanks !
... View more
Labels:
03-17-2005
12:57 PM
Several things come to mind... Set your mtu on the vpn client box to 1300 (its one of the defaults) on all "LAN" adapters... Also turn on Nat Traversal "isakmp nat-traversal"
... View more
02-12-2005
12:45 AM
No. The mrtg per ip monitors (in the contrib directory) use a combination of ip accounting, and snmp write strings to do periodic resets of the data. So obviously this was designed to work on IOS only. To monitor whats coming off the inside pix interface setup a cheap linux box (red hat is best!) and run ntop (see ntop.org). this is very easy to do and will get you far better results than anything mrtg can do. Now you will just need a span port or a real layer 1 hub to catch the data off the pix inside int. JB
... View more
Created by
noc
in VPN and AnyConnect
in VPN and AnyConnect
01-24-2004
02:18 AM
01-24-2004
02:18 AM
I see this alot. Rarely is it a linksys setting problem. Usually the person had a nic card (wired) when the vpn software was installed. So the "Deterministic netowrk enhancer" was bound to the wired nic, and is not to the wireless adapater once added later on. The fix to this obviously is to remove and re-install the vpn software. IF you are running an older version (say 3.6), and upgrade to the latest and greatest vpn client should fix. I don't think this has to do with WEP, as wep does not "see" the encrypted packets (which are decrypted) at the linksys before going to the internet.
... View more
Created by
noc
in Other Network Architecture Subjects
in Other Network Architecture Subjects
10-11-2003
12:14 AM
10-11-2003
12:14 AM
Great Answer ! Thanks !
... View more
Created by
noc
in Other Network Architecture Subjects
in Other Network Architecture Subjects
10-10-2003
10:24 PM
10-10-2003
10:24 PM
when you configure a bridge-group (to make a 2948-L3 more like a switch) and try to allow only 1 mac address per port, using the interface command, 2948-L3(Config-if)#bridge-group 10 input-address-list 701 (where 701 is a mac address access list), it does not work.. the only way I have been able to do this, is to apply to a software interface, like port-channel 1) Can you apply these on a 2948-L3, (it of course works great on a router).. What I need to do is port security (like a 3550) on a 2948-L3, where only 1 IT dept approved mac can get on any fastethernet port. I apply the input-address-list and nothing is blocked.... Any mac can still transmit (security does not work) Please help ! bridge irb ! ! ! ! interface FastEthernet1 no ip address no ip directed-broadcast bridge-group 10 bridge-group 10 input-address-list 701 bridge-group 10 spanning-disabled ! access-list 701 permit 0001.e69f.3015 0000.0000.0000 access-list 701 deny 0000.0000.0000 ffff.ffff.ffff ! ! interface BVI10 ip address 10.10.10.1 255.255.255.0 no ip directed-broadcast ! ! bridge 10 protocol ieee bridge 10 route ip bridge 10 priority 60000
... View more
Labels:
04-10-2003
06:27 AM
Sorry but this is not possible (I don't even think with CSS or any thing I have ever heard of) Given TCP and everything I know about it, I don't think could ever be possible, unless the load balancer was handling layer 4 and down and doing all negotiation layers 5 to 7. Tweaking the predicator (method of determining who gets NEW connections) will allow you to make sure any NEW sessions made don't go to the second server (because it will already have some established connections), but any EXISTING connections will remain on the server which has been up for the entire time of the connection. The Predicator I use is "Least Conns" so the server with the least ACTIVE connections always gets the new requests for service off the VIP. If you run Least conns as well, you can be pretty sure to evenly distribute your connections amoungst the number of "real" servers in your pool. You should convince your management that more "real" servers are needed to protect against this crash that the Local Director (LB) was never invented for. Say if you had 8 servers instead of 2, then you would not crash the remaining servers if one failed.
... View more
Created by
noc
in Security Management
in Security Management
09-24-2002
08:39 AM
09-24-2002
08:39 AM
if the vpn 3002 has dns enabled Configuration | System | Servers | DNS and the 3002 is learning dns from its dhcp source (a cable modem isp, or other way) the 3002 passes this info to the clients when its gives them IP addresses from its dhcp server configured in Configuration | System | IP Routing | DHCP the dns etc, configured in groups on the 3030 is not used unless your passing this thru to the induvidual clients, which is a bad scenario...
... View more
Created by
noc
in Security Management
in Security Management
09-24-2002
08:35 AM
09-24-2002
08:35 AM
go to Configuration | Policy Management | Traffic Management | Assign Rules to Filter highlight public and select "assign rules to filer" highlight everything except IKE/IPSEC related rules and hit remove.. just be sure to leave GRE if your using PPTP and L2TP if your using that. not http/https rules should be allowed via the public filter (which corresponds to the public interface) private interface will always allow everything..so dont worry about it.
... View more
09-24-2002
08:27 AM
Looks like NIMDA virus from around is scanning and hitting your public interface. I would lock your public interface down from HTTP/https and of course, everything. Nimda is treating the vpn's webserver like IIS on a microsoft box, and trying to crack its way into directories and get rights to do damage. I doubt it can hurt the vpn, by why risk problems, crashes and the cpu overhead
... View more
Created by
noc
in Other Network Architecture Subjects
in Other Network Architecture Subjects
05-10-2002
07:43 PM
05-10-2002
07:43 PM
I have to go to a competitors website and post in the message board to get information about my product.. Scary Stuff... I think you should ebay that thing now and get a 3524 or 3550 from Cisco ! Its no wonder foundry is nearly out of business !
... View more
Created by
noc
in Other Security Subjects
in Other Security Subjects
05-10-2002
07:32 PM
05-10-2002
07:32 PM
do an SNMP walk of the entire mib tree. see if openview find a mib in can "manage" for the tunnel to a remote or a client connection.
... View more
07-15-2005
Wrong pinout... the vpn 3005 does not use null modem cables...its a
straight cat 5 cable! so, just c...
06-17-2005
the VPN 3000 series login to active directory (kerberos) really doesn't
work. It has never worked on...
Created by
noc
in VPN and AnyConnect
04-15-2005
04-15-2005
Just so you don't go crazy; I tried here with "kerberos" and for 3
months could not get it working.....
04-11-2005
Guys and Gals,I need to allow a level 9 user in my switches the ability
to manage interfaces f0/1 to...
03-17-2005
Several things come to mind...Set your mtu on the vpn client box to 1300
(its one of the defaults) o...
02-12-2005
No.The mrtg per ip monitors (in the contrib directory) use a combination
of ip accounting, and snmp ...
01-24-2004
I see this alot. Rarely is it a linksys setting problem. Usually the
person had a nic card (wired) w...
Created by
noc
in Other Network Architecture Subjects
10-10-2003
10-10-2003
when you configure a bridge-group (to make a2948-L3 more like a
switch)and try to allow only 1 mac a...
04-10-2003
Sorry but this is not possible (I don't even think with CSS orany thing
I have ever heard of) Given ...
09-24-2002
if the vpn 3002 has dns enabledConfiguration | System | Servers | DNSand
the 3002 is learning dns fr...
09-24-2002
go to Configuration | Policy Management | Traffic Management | Assign
Rules to Filterhighlight publi...
09-24-2002
Looks like NIMDA virus from around is scanning and hitting your
publicinterface. I would lock your p...
Created by
noc
in Other Network Architecture Subjects
05-10-2002
05-10-2002
I have to go to a competitors website and post in the message board to
get information about my prod...
Created by
noc
in Other Security Subjects
05-10-2002
05-10-2002
do an SNMP walk of the entire mib tree. see if openview find a mib in
can"manage" for the tunnel to ...
Public Statistics
| Date Registered | 12-08-2000 12:52 PM |
| Date Last Visited | 08-18-2017 03:50 AM |
| Total Messages Posted | 71 |
| Total Helpful Votes Received | 9 |
