Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About cmi_marketing
Stats
Member since
02-14-2012
13
Posts
0
Helpful
0
Solutions
Created by
cmi_marketing
in VPN and AnyConnect
in VPN and AnyConnect
04-30-2012
08:55 AM
04-30-2012
08:55 AM
Roberto Thanks for info. I'll start digging in, and let you know how it works. I checked the liceneses and applied them. I rebooted the ASA and strangly still doesnt enable the Anyconnect Essentials. ...see below: I will not read into it..I'll move forward with the rest of the instructions that you posted. Licensed features for this platform: Maximum Physical Interfaces : Unlimited Maximum VLANs : 150 Inside Hosts : Unlimited Failover : Active/Active VPN-DES : Enabled VPN-3DES-AES : Enabled Security Contexts : 2 GTP/GPRS : Disabled SSL VPN Peers : 2 Total VPN Peers : 750 Shared License : Disabled AnyConnect for Mobile : Enabled AnyConnect for Cisco VPN Phone : Disabled AnyConnect Essentials : Disabled Advanced Endpoint Assessment : Disabled UC Phone Proxy Sessions : 2 Total UC Proxy Sessions : 2 Botnet Traffic Filter : Disabled This platform has an ASA 5520 VPN Plus license.
... View more
Created by
cmi_marketing
in VPN and AnyConnect
in VPN and AnyConnect
04-27-2012
07:39 AM
04-27-2012
07:39 AM
Marcin - Thanks for the reply. I do have the Anyconnect client. How do I configure Anyconnect to LDAP? Not sure if I should use the GUI or command line. GUI seems more intuitive since I'm a step above a VPN novice. When I setup my SITE to SITE VPN between my building and another building, it really junked up my config. Thanks in advance.
... View more
Created by
cmi_marketing
in VPN and AnyConnect
in VPN and AnyConnect
04-27-2012
07:34 AM
04-27-2012
07:34 AM
Roberto - Thanks for the info. I purchased a bunch of licenses. One of which was the Anyconnect Essentials, so not sure why it is showing 'disabled'. Here is what it looks like when I do a show ver. Hardware: ASA5520, 2048 MB RAM, CPU Pentium 4 Celeron 2000 MHz Internal ATA Compact Flash, 256MB BIOS Flash Firmware Hub @ 0xffe00000, 1024KB Encryption hardware device : Cisco ASA-55x0 on-board accelerator (revision 0x0) Boot microcode : CN1000-MC-BOOT-2.00 SSL/IKE microcode: CNLite-MC-SSLm-PLUS-2.03 IPSec microcode : CNlite-MC-IPSECm-MAIN-2.05 Licensed features for this platform: Maximum Physical Interfaces : Unlimited Maximum VLANs : 150 Inside Hosts : Unlimited Failover : Active/Active VPN-DES : Enabled VPN-3DES-AES : Enabled Security Contexts : 2 GTP/GPRS : Disabled SSL VPN Peers : 2 Total VPN Peers : 750 Shared License : Disabled AnyConnect for Mobile : Disabled AnyConnect for Cisco VPN Phone : Disabled AnyConnect Essentials : Disabled Advanced Endpoint Assessment : Disabled UC Phone Proxy Sessions : 2 Total UC Proxy Sessions : 2 Botnet Traffic Filter : Disabled This platform has an ASA 5520 VPN Plus license. Any config ideas on how to set the Anyconnect to LDAP?
... View more
Created by
cmi_marketing
in VPN and AnyConnect
in VPN and AnyConnect
04-26-2012
08:31 AM
04-26-2012
08:31 AM
I am looking for some advice. I have roughly 50 users that are remote, and use VPN to access the resources in my network such as file servers, application servers etc. We currently use Microsoft VPN to authenticate those users. It works, but I am not a fan on Microsoft VPN. I have purchased an ASA5520 to replace my crappy layer 3 HP core backbone switch, and plan on replacing my Microsoft VPN with Cisco VPN. I want to configure my ASA so my remote users can continue to VPN into my network securely, but also want them to authenticate from their Active Directory credentials. Is this possible? If authenticating to AD from Cisco is not traditional, and problematic, then I am open to suggestions. I do not have web licenses, only the Anyconnent. Thanks.
... View more
Labels:
Created by
cmi_marketing
in Switching
in Switching
03-23-2012
01:59 PM
03-23-2012
01:59 PM
First off, I'm a Fiber noob, so be gentle. Company I work for just moved into a new location. We have two data closets which are patched as independent entities, with no Ethernet tie connection. These closets are roughly 100 feet apart. There is a fiber connection that runs between both closets, that the previous tenant used to connect the switches. I have placed a Cisco 2960 switch in each location, and added one mini SFP gbic's to each switch. After attaching both sides, neither light up. I do a sh inter gig1/0/49 on each and shows 'down down' (not admin down). What is the trick on getting these to communciate, do I need to configure these ports, and are they supposed to light up? What I am trying to accomplish is to get the one closet that is completely cut off, communicating by logically stacking, or 'daisy chaining' via fiber. I turned off the lights and popped the fiber out, and I do see a faint red light (I did not look straight into it), so I think the fiber is active. I am open ears to a sound fix.
... View more
Labels:
Created by
cmi_marketing
in IP Telephony and Phones
in IP Telephony and Phones
03-05-2012
07:02 PM
03-05-2012
07:02 PM
I have a question that I was hoping someone could help with. I am a Cisco VOIP noob, and have been tasked with implementing a new VOIP network in May. I do not have the components, but trying to conceptualize my architecture, prior to purchasing components. I am chasing my tail, and I am not comprehending how to utilize a Cisco VOIP VLAN in conjunction with a data VLAN's and 2 port switch on the phone. I have 100 users, and have 144 ports total on my POE Cisco 2960's. Totally confused on how implement and use the ports I have. If I have 100 users, does that mean I need 200 ports to implement? Here is where I can not conceptualize communication. Lets say that I have a face plate in an office labeled 7A, and 7A plugs into port 2 on my Cisco 2960 switch, and is designated to VLAN 2 for sales. 7A plugs into the 1st port on the Cisco phone, and the second port on the phone goes to the computer and should communicate on VLAN 2. How am I supposed to get the phone to communicate on it's Voice VLAN if plugged into the Sales VLAN? OR - If I create a VLAN for voice on the 2960 and plug that from the wall to the phone, how am I supposed to get the computer to communicate on Sales VLAN? I am sure there is an easy solution that I am not getting.
... View more
Labels:
Created by
cmi_marketing
in Switching
in Switching
02-22-2012
07:46 AM
02-22-2012
07:46 AM
Ok..This was resolved. For anyone that has a similar issue, the problem had nothing to do with the switch. I missed a necessary step on the ASA. I did have part of the command but overlooked the rest of it. dhcprelay server 10.10.30.2 vlan0030 From the config listed in my earlier post, you can see I added the dhcprelay command already. What I didn't do was add the enable command. Below are commands that needed to be run. You need to enable the command for every vlan on your network that requires DHCP from your Windows network. dhcprelay server 10.10.30.2 vlan0030 dhcprelay enable vlan0010 dhcprelay enable vlan0020
... View more
Created by
cmi_marketing
in Switching
in Switching
02-17-2012
05:29 AM
02-17-2012
05:29 AM
glen.grant I probably should have added that in the first place. I have listed both (what i think are) relevant areas of the switch and firewall. If you need to take a look at the entire ASA config, I attached that with my initial posting. Switch interface FastEthernet0/1 switchport trunk encapsulation dot1q switchport trunk allowed vlan 1,10,20,30,1002-1005 switchport mode trunk ! interface FastEthernet0/2 ! interface FastEthernet0/3 switchport access vlan 20 ! interface FastEthernet0/4 switchport access vlan 10 ! interface FastEthernet0/5 switchport access vlan 10 ! interface FastEthernet0/6 ! interface FastEthernet0/7 switchport access vlan 10 ! interface FastEthernet0/8 ! interface FastEthernet0/9 switchport access vlan 30 ! interface FastEthernet0/10 ! interface FastEthernet0/11 switchport access vlan 30 ! interface VLAN1 no ip address no ip directed-broadcast no ip route-cache shutdown ! interface VLAN10 ip helper-address 10.10.30.2 no ip directed-broadcast no ip route-cache ! interface VLAN20 ip helper-address 10.10.30.2 no ip directed-broadcast no ip route-cache shutdown ! interface VLAN30 ip helper-address 10.10.30.2 no ip directed-broadcast no ip route-cache shutdown ASA Version 8.2(5) ! hostname ciscoasa enable password 8Ry2YjIyt7RRXU24 encrypted passwd 2KFQnbNIdI.2KYOU encrypted names ! interface GigabitEthernet0/0 shutdown nameif outside security-level 0 no ip address ! interface GigabitEthernet0/1 shutdown no nameif security-level 100 no ip address ! interface GigabitEthernet0/2 no nameif no security-level no ip address ! interface GigabitEthernet0/2.10 vlan 10 nameif vlan0010 security-level 100 ip address 10.10.10.1 255.255.255.0 ! interface GigabitEthernet0/2.20 vlan 20 nameif vlan0020 security-level 100 ip address 10.10.20.1 255.255.255.0 ! interface GigabitEthernet0/2.30 vlan 30 nameif vlan0030 security-level 100 ip address 10.10.30.1 255.255.255.0 ! interface GigabitEthernet0/3 shutdown no nameif no security-level no ip address ! interface Management0/0 nameif management security-level 100 ip address 192.168.1.1 255.255.255.0 management-only same-security-traffic permit inter-interface same-security-traffic permit intra-interface access-list capin extended permit ip any 10.10.20.0 255.255.255.0 access-list capin extended permit ip 10.10.20.0 255.255.255.0 any access-list capin extended permit ip any 10.10.10.0 255.255.255.0 access-list capin extended permit ip 10.10.10.0 255.255.255.0 any access-list capin extended permit ip 10.10.30.0 255.255.255.0 any access-list capin extended permit ip any 10.10.30.0 255.255.255.0 access-list permit extended permit icmp interface vlan0030 any access-list permit extended permit icmp interface vlan0010 any dhcpd address 192.168.1.2-192.168.1.254 management dhcpd enable management ! dhcprelay server 10.10.30.2 vlan0030 dhcprelay timeout 90 threat-detection basic-threat threat-detection statistics access-list no threat-detection statistics tcp-intercept webvpn ASA ASA Version 8.2(5) ! hostname ciscoasa enable password 8Ry2YjIyt7RRXU24 encrypted passwd 2KFQnbNIdI.2KYOU encrypted names ! interface GigabitEthernet0/0 shutdown nameif outside security-level 0 no ip address ! interface GigabitEthernet0/1 shutdown no nameif security-level 100 no ip address ! interface GigabitEthernet0/2 no nameif no security-level no ip address ! interface GigabitEthernet0/2.10 vlan 10 nameif vlan0010 security-level 100 ip address 10.10.10.1 255.255.255.0 ! interface GigabitEthernet0/2.20 vlan 20 nameif vlan0020 security-level 100 ip address 10.10.20.1 255.255.255.0 ! interface GigabitEthernet0/2.30 vlan 30 nameif vlan0030 security-level 100 ip address 10.10.30.1 255.255.255.0 ! interface GigabitEthernet0/3 shutdown no nameif no security-level no ip address ! interface Management0/0 nameif management security-level 100 ip address 192.168.1.1 255.255.255.0 management-only same-security-traffic permit inter-interface same-security-traffic permit intra-interface access-list capin extended permit ip any 10.10.20.0 255.255.255.0 access-list capin extended permit ip 10.10.20.0 255.255.255.0 any access-list capin extended permit ip any 10.10.10.0 255.255.255.0 access-list capin extended permit ip 10.10.10.0 255.255.255.0 any access-list capin extended permit ip 10.10.30.0 255.255.255.0 any access-list capin extended permit ip any 10.10.30.0 255.255.255.0 access-list permit extended permit icmp interface vlan0030 any access-list permit extended permit icmp interface vlan0010 any dhcpd address 192.168.1.2-192.168.1.254 management dhcpd enable management ! dhcprelay server 10.10.30.2 vlan0030 dhcprelay timeout 90 threat-detection basic-threat threat-detection statistics access-list no threat-detection statistics tcp-intercept webvpn
... View more
Created by
cmi_marketing
in Switching
in Switching
02-16-2012
12:56 PM
02-16-2012
12:56 PM
Reza_Sharifi Thanks for the reply. I checked the ASA, and I do not have the option for 'inside'. when i run the command dhcprelay enable ...I have options: Management Outside VLAN0010 VLAN0020 VLAN0030
... View more
Created by
cmi_marketing
in Switching
in Switching
02-16-2012
11:30 AM
02-16-2012
11:30 AM
ISSUE: Can't ping the gateway of other VLAN's, which is causing a problem getting DHCP from Active Directory. I have a straight forward config in my test lab. I have an ASA5520 (3 vlans) and Cisco layer2 Swtich. I have a total of 3 VLAN's: Vlan0010 - 10.10.10.1 (gateway) Vlan0020 - 10.10.20.1 (gateway) Vlan0030 - 10.10.30.1 (gateway) Vlan 30 can ping with other machines in the test lab through Vlan 20 and Vlan 10. When I give a machine a static address, I can authenticate to my Active Directory DC regardless of the VLan. When I remove the static address and attempt to connect via DHCP, it fails. All the subnets are configured accordingly, but the PC's in the vlan0020 and vlan0010 do not get address. I can not ping the gateway of other Vlan's, but I can ping the machines within the Vlans. I can however get DHCP address from machines inside the VLAN30. I have created the IP helper command on the VLan's on the switch (ip helper-address 10.10.30.2), and have added the dhcprelay server 10.10.30.2 vlan0030 command on the ASA. I need to be able to communicate with the gateway's so I can get DHCP from machines outside the Vlans my Actice Directory DC resides. Vlan0030 - DHCP server, machines on this VLAN get get DHCP, can't ping gateway of Vlan0020 or Vlan0010 Vlan0020 - These machines can't get DHCP address or ping the Vlan0030 gateway. Can ping machines in different VLans. Vlan0010 - These machines can't get DHCP address or ping the Vlan0030 gateway. Can ping machines in different VLans. ASA Config provided below.
... View more
Labels:
Created by
cmi_marketing
in Switching
in Switching
02-15-2012
12:55 PM
02-15-2012
12:55 PM
glen.grant This worked. I had a VLAN mismatch. Once I made the change on the ASA, all my VLAN's started to communicate. Thanks for the tip and fix!
... View more
Created by
cmi_marketing
in Switching
in Switching
02-15-2012
10:45 AM
02-15-2012
10:45 AM
glen.grant thanks for the speedy response. I did create the VLAN's on the layer 2 switch by going into vlan database. I'll go back and blow them away and make sure that they are set correctly, and I'll test and repost.
... View more
Created by
cmi_marketing
in Switching
in Switching
02-15-2012
09:57 AM
02-15-2012
09:57 AM
I'm looking for some advice and guidance. Having issues with my new architecture in my test lab. I have been tasked with building a new environment for our expanding company. Currently have 80 users, and having a hiring blitz and will be at 120 users by Sept. We are moving to a larger environment in May to facilitate all users under 1 roof. In my test environment, I am trying to duplicate the IP and VLAN architecture which I will be rolling out, but have not been successful in my test. I have an ASA5520, and an older Cisco Layer 2 switch (3600XL). Part of the new network will consist of multiple VLAN's. One VLAN for infrastructure devices, a few to segregate the departments, VPN, wireless, and eventually VOIP. The production switches will consist of POE to facilitate VOIP, but have not purchased that equipment yet. I am currently testing with one switch, but will add another to test functionality via daisy chain (i know this isn't the best method). I am trying to see if I can test my config and architecture with the current devices, but not successful in communicating through the PC's on each VLAN. The over all goal is to communicate through the VLANs to prove concept such as communicating to network shares, authenticating to Active Directory, and then to the internet. Since I currently do not have this connected to any internet circuit, I am however, trying to test the communication between VLAN's. I can't communicate accros VLAN's. My XP machine does not authenticate to my AD server, and they can not ping one another (spec below). What do I need, or what do I need to do to get these devices to communicate with the environment explained above. I suspect it is a limitation of SVI. Currently 3 VLANs VLAN 10: Two servers on the: 10.10.10.X network with the gateway as 10.10.10.1 One of those two servers is my Active Directory These two machines communicate with each other successfully, but can't communicate with VLAN 20. I can not run the command "no shutdown" on the VLAN 10. VLAN 20: Currently an XP laptop 10.10.20.X network with gateway as 10.10.20.1 This can not communicate with VLAN 10 VLAn 30: Not in use yet ASA: Router on a Stick Config attached Switch1: Config attached but listed a quick snippet interface FastEthernet0/1 switchport trunk encapsulation dot1q switchport trunk allowed vlan 1,10,20,30,1002-1005 switchport mode trunk ! interface FastEthernet0/3 switchport access vlan 20 switchport trunk encapsulation dot1q switchport trunk native vlan 20 ! interface FastEthernet0/5 switchport access vlan 10 switchport trunk encapsulation dot1q switchport trunk native vlan 10 !! interface FastEthernet0/7 switchport access vlan 10 switchport trunk encapsulation dot1q !! interface FastEthernet0/9 switchport access vlan 30 switchport trunk encapsulation dot1q ! interface VLAN1 no ip address no ip directed-broadcast no ip route-cache shutdown ! interface VLAN10 no ip directed-broadcast no ip route-cache shutdown ! interface VLAN20 no ip directed-broadcast no ip route-cache ! access-list 10 permit 10.0.0.0 0.255.255.255
... View more
Labels:
04-30-2012
RobertoThanks for info. I'll start digging in, and let you know how it
works. I checked the licenese...
04-27-2012
Marcin -Thanks for the reply. I do have the Anyconnect client. How do I
configure Anyconnect to LDAP...
04-27-2012
Roberto -Thanks for the info. I purchased a bunch of licenses. One of
which was the Anyconnect Essen...
04-26-2012
I am looking for some advice. I have roughly 50 users that are remote,
and use VPN to access the res...
03-23-2012
First off, I'm a Fiber noob, so be gentle. Company I work for just moved
into a new location. We hav...
03-05-2012
I have a question that I was hoping someone could help with. I am a
Cisco VOIP noob, and have been t...
Created by
cmi_marketing
in Switching
02-22-2012
02-22-2012
Ok..This was resolved. For anyone that has a similar issue, the problem
had nothing to do with the s...
Created by
cmi_marketing
in Switching
02-17-2012
02-17-2012
glen.grantI probably should have added that in the first place. I have
listed both (what i think are...
Created by
cmi_marketing
in Switching
02-16-2012
02-16-2012
Reza_SharifiThanks for the reply. I checked the ASA, and I do not have
the option for 'inside'. when...
Created by
cmi_marketing
in Switching
02-16-2012
02-16-2012
ISSUE: Can't ping the gateway of other VLAN's, which is causing a
problem getting DHCP from Active D...
02-15-2012
glen.grantThis worked. I had a VLAN mismatch. Once I made the change on
the ASA, all my VLAN's start...
02-15-2012
glen.grantthanks for the speedy response. I did create the VLAN's on the
layer 2 switch by going int...
Public Statistics
| Date Registered | 02-14-2012 10:29 AM |
| Date Last Visited | 05-01-2018 12:14 PM |
| Total Messages Posted | 13 |
