Hii Can you please do a debug ip ospf events and debug ip ospf packets on cisco switches after you do a clear ospf neighbors..and paste o/p here for further analysis ? Also paste the relevant configs from cisco switches, and any logs you are getting.. FYI if you open a TAC case.. it be lot easier.. HTH Vijaya ... View more

Hii, Looks like some of the config related to accessing the switch was not saved , when you did reload after the IOS upgrade.. Try to verify if your ssh/telnet configs are still correct and any routes are not missing. Also try to console [physical access] to device and check if the device is not stuck in rommon.. HTH Vijaya ... View more

Hello, YES even with dual stack you will still need to configure tunneling for communications between two IPv6 islands..over IPv4 cloud. Options available in dual stacking mode are :- 1.  Manually configured tunnels [pt to pt] 2.  GRE tunnel [Pt to pt..Can carry CLNS traffic too for IS IS  too..!] 3  Automatic ipv4 compatible tunnels [DEPRECATED..pt to mpt, Cisco recommends using ISATAP tunneling instead] HTH Vijaya ... View more

Hii, To find out which type of GBIC connector is present in your SUP2 right now, you can issue:- show inventory show int x/y trasceiver detail Also,once you know the model of GBIC , try to lookup CCO and find compatiblity matrix for 7200 hw and sw and you will be all set..! HTH Vijaya ... View more

Hello, Just to add to what reza said, this particular setup of ether channel is known as MultiChassis Ether Channel (MEC) on CAT 6500 platforms. All ports of standby chassis forward data traffic along with active chassis. Thank you Vijaya ... View more

Hello, Just to add what Halijenn already informed about the static translation, the inbound ACL in 8.3 code, bound to the outside interface, should include the Local IP address of host, instead of Public IP address (peculiar of 8.3 code!). Thank you Vijaya ... View more

Hello, I would suggest you to configure a span session on the switch behind your firewall and then try to filter output based on exact IP address being seen using Wireshark. This way you can track down the host behind your network who may be trying to spoof IP addresses with the help of mac address-table and arp table. HTH Vijaya ... View more

Hello, Static translation for DMZ server : static (dmz,outside) netmask 255.255.255.255 access-list inbound extended permit tcp any host access-group inbound in interface outside // to permit the inbound TCP connections from any outside IP address to the public IP address of server// Now, coming to your DNS resolution, I would need to know, where is you DNS server located ? For the external clients, external DNS server would take care of name resoultion. Thank Vijaya ... View more

Hello, Make sure you have the 2nd PC responding correctly. The best way to check if the ASA is actually getting  packets on its outside interface for the perticular connection or not is via packet captures. Also, if you have ASA with 7.2 or higher code, you can use packet-tracer to verify the connectivity. Make sure, the hops (router etc) have allowed the connection to IP address of second PC. Thanks, Vijaya ... View more

Hello, Firewall BYPASSES interface access-list check for traffic between two different interfaces with same-security whenever same-secuirty-traffic permit inter-interface is turned ON. You can verify the same by looking at hitcounts of interface ACLs (show access-list) after initiating traffic between two hosts on same-sec DIfferent interface. Make sure you have Identity NAT from subnets to allow communication. HTH Vijaya ... View more

Hello, In addition to what has been pointed already by Karuppuchamy Malaiyandi I would like to inform you that ASA cannot do deep packet inspection. This means that ASA can not filter websites using HTTPS. All the HTTP websites can be filtered using the Modular Polidy Framework on the box (See sample config below). In order to do advanced filtering of websites you may have to use Security modules, or 3rd party Webfilters for e.g. Websense Sample config to block www.yahoo.com and www.google.com sites for any user : regex url1 "mail.yahoo.com" regex url2 "mail.google.com" class-map type regex match-any urlreg match regex url1 match regex url2 class-map type inspect http match-all http_url_policy match request header host regex class urlreg access-l http permit tcp any any eq 80 class-map acl match access-list http policy-map type inspect http http_policy parameters class http_url_policy   drop-connection policy-map httpdrop class acl   inspect http http_policy service-policy httpdrop interface outside Feel free to read more below ASA/PIX 8.x: Block Certain Websites (URLs) Using Regular Expressions With MPF Configuration Example: http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080940e04.shtml HTH Vijaya ... View more

Hello, Your question is not very clear as to where your users/client and server would be located (which ifc of ASA). Though what I understand, is that you want to have internal (behind inside ifc of ASA) users and you want them to be able to access an external website using an internal IP even though the external DNS server sends server's external IP address in the DNS reply. So, here firewall needs to rewrite the DNS qreply packet coming back to client. This scenario of "Destination NAT" can be achieved as follows : static (outside,inside) netmask 255.255.255.255 dns HTH Vijaya ... View more