Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About virtuali1151
Stats
Member since
08-09-2018
39
Posts
15
Helpful
2
Solutions
Created by
virtuali1151
in Network Management
in Network Management
03-04-2019
01:53 PM
03-04-2019
01:53 PM
Hi All, For the S2S VPN tunnel bandwidth throughput does anybody know if that total is bi-directional? For example the cisco 5545 has a max bandwidth of 400M, does that mean its 200M up and 200M down? or 400M up and 400M Down? 3DES/AES VPN Throughput [6] 400 Mbps Thanks in advance.
... View more
Created by
virtuali1151
in Network Management
in Network Management
02-04-2019
09:00 AM
02-04-2019
09:00 AM
Hey Marce, Ok, any idea how to check that? And do you know the max bandwidth of the Ipsec VPN tunnels? Tks.
... View more
Created by
virtuali1151
in Network Management
in Network Management
02-04-2019
07:25 AM
02-04-2019
07:25 AM
Hi All, Does anybody no how I can actually monitor the amount of bandwidth my current traffic is using going across my S2S VPN tunnel? Also, does anybody know the max bandwidth for the tunnels? Thanks in advance.
... View more
Labels:
01-31-2019
08:37 AM
Hi there, Actually figured this out. I was missing the static route on our GW to the Azure Tenant. Once I added that it was all good.
... View more
01-31-2019
08:13 AM
Hi John, I suspect I am missing something with a route. I can ping/trace as per the below it works fine from our core switch device. for example: 10.1.1.1 ---> 10.211.20.100 CSW01#ping 10.211.20.100 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.211.20.100, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 25/35/50 ms Tracing the route to 10.211.20.100 1 10.211.1.8 42 msec 34 msec 25 msec ----------------------------------------------------- Now if I try from our Gateway switch it doesnt work. Example: 10.1.64.18----> 10.211.20.100 GW1#ping 10.211.20.100 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.211.20.100, timeout is 2 seconds: ..... Success rate is 0 percent (0/5) GW1#traceroute 10.211.20.100 Type escape sequence to abort. Tracing the route to 10.211.20.100 VRF info: (vrf in name/id, vrf out name/id) 1 209.11.125.184 0 msec 0 msec 0 msec 2 * * *
... View more
01-31-2019
07:56 AM
Hi John, Our setup goes like this. So if I ping from my GW switch 10.1.1.1--> to the Azure Tenant Device 10.211.20.100 I can reach it fine. CSW01>ping 10.211.20.100 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.211.20.100, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 25/30/34 ms ------------------------------------------------- CSW01>traceroute 10.211.20.100 Type escape sequence to abort. Tracing the route to 10.211.20.100 1 10.211.1.7 34 msec 10.211.1.8 25 msec 33 msec ------------------------------------------------- If I try to ping or trace from my 2nd floor switch I cant: So if I ping from my GW switch 10.1.64.18--> to the Azure Tenant Device 10.211.20.100 it fails. GW1#ping 10.211.20.100 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.211.20.100, timeout is 2 seconds: ..... Success rate is 0 percent (0/5) -------------------------------- GW1#traceroute 10.211.20.100 Type escape sequence to abort. Tracing the route to 10.211.20.100 VRF info: (vrf in name/id, vrf out name/id) 1 209.13.153.174 0 msec 0 msec 0 msec 2 * * *
... View more
01-31-2019
07:16 AM
Hello, I have a strange issue. We have some servers in Azure tenants via a S2S VPN tunnel. I can ping the server (10.211.20.100) from our main switch 10.1.1.1 no problem, but from our 2nd floor switch that is connected to the main switch I cant? Is there something I am missing why I cant ping from the 2nd floor switch? These are 2960' switches. Thanks in advance.
... View more
Labels:
Created by
virtuali1151
in Network Management
in Network Management
01-08-2019
12:44 PM
01-08-2019
12:44 PM
an addition to this, I have updated our Firepower modules as well. So I am not sure if this might be contributing to the possibility of this issue too. Perhaps IDS/IPS?
... View more
Created by
virtuali1151
in Network Management
in Network Management
01-08-2019
10:02 AM
01-08-2019
10:02 AM
Hi All, I recently upgraded our Cisco ASA 5545 to version 9.9(2)36. Since the upgrade we are not able to transfer files to/from our Azure tenants via the site to site vpn we have setup. Here is an example: vpn, tunnel Local Server: 10.1.1.151 Azure server: 10.211.20.100 We can ping both ways fine, but file trans are failing. It just hangs when I try a transfer. For the monitoring I am seeing TCP Reset-I from inside. Could this be the reason the file transfers are failing? If so, anybody have any idea how to remedy that reset?? Jan 08 2019 08:25:33 302014 10.211.20.100 445 10.1.1.151 51178 Teardown TCP connection 38499637 for outside:10.211.20.100/445 to inside:10.1.1.151/51178 duration 0:05:53 bytes 5384 TCP Reset-I from inside Thanks in advance.
... View more
Labels:
Created by
virtuali1151
in Network Management
in Network Management
12-14-2018
11:08 AM
12-14-2018
11:08 AM
I had to change my interfaces to ANY/ANY and apply applicable subnets. This had to be done because of the multiple interfaces the traffic is going on.
... View more
Created by
virtuali1151
in Network Management
in Network Management
12-13-2018
08:38 AM
12-13-2018
08:38 AM
Hey Dennis, Here is some more logs... FILTER:srcIP=10.211.20.10;dstIP=10.1.90.14; %ASA-5-305013: Asymmetric NAT rules matched for forward and reverse flows; Connection protocol src interface_name:source_address/source_port [(idfw_user)] dst interface_name:dst_address/dst_port [(idfw_user)] denied due to NAT reverse path failure. When not on the same interface as the host using NAT, use the mapped address instead of the actual address to connect to the host. In addition, enable the inspect command if the application embeds the IP address. Asymmetric NAT rules matched for forward and reverse flows; Connection for udp src outside:10.211.20.10/57160 dst ED:10.1.90.14/53 denied due to NAT reverse path failure Any ideas?
... View more
Created by
virtuali1151
in Network Management
in Network Management
12-12-2018
08:25 AM
12-12-2018
08:25 AM
I'm still getting this error: Asymmetric NAT rules matched for forward and reverse flows; Connection for udp src outside denied due to NAT reverse path failure. Any ideas? Tks in advance.
... View more
Created by
virtuali1151
in Network Management
in Network Management
12-11-2018
03:43 PM
12-11-2018
03:43 PM
Hi Dennis, Sorry, I should have put that.. it is in the Onprem group object. When I do the packet trace from the inside interface it works fine.. but when I do it from the outside interface which is where the Azure sub is coming from via the S2S VPN tunnel it gets all the way through to VPN Lookup and drops: error is: Subtype - IPsec-tunnel-flow action: drop.
... View more
Created by
virtuali1151
in Network Management
in Network Management
12-11-2018
03:08 PM
12-11-2018
03:08 PM
Hi All, I am having an issue with my Azure subnets (10.210.0.0/16, 10.211.0.0/16) being able to access my prem subnets over a S2S VPN tunnel. So currently everything is work fine from my inside internal range (10.1.1.0/24). As an example when I try to access say ports 88,53,389 etc from the Azure controllers (10.211.20.10, 10.211.20.11) to the Prem Controller (10.1.1.159) it is fine, but when I try to access them from the same Azure controllers to say another local controller 10.1.90.14 I get the following error in the log: Asymmetric NAT rules matched for forward and reverse flows; Connection for udp src outside:10.211.20.11/57160 dst ED:10.1.90.14/53 denied due to NAT reverse path failure. Now this is the current NAT: nat (inside,outside) source static OnPremisesNetworks OnPremisesNetworks destination static Azure-Networks Azure-Networks no-proxy-arp route-lookup The OnPremisesNetworks group object has the inside networks (10.1.1.0/24, 10.1.60.0/24) and the Azure-Networks has the (10.211.0.0/16, 10.210.0.0/16) Networks. Now think this might be related to the ED subnet 10.1.90.0/24 residing on another interface: interface GigabitEthernet0/2.414 description ED vlan 414 nameif ED security-level 100 ip address 10.1.90.254 255.255.255.0 where the inside interface is: interface GigabitEthernet0/1 nameif inside security-level 100 ip address 10.1.1.142 255.255.255.0 So my question is how to resolve that Asymmetric NAT issue?? What would be the correct NAT'ing for my situation. Thanks in advance.
... View more
- Tags:
- nat asa
Labels:
11-20-2018
07:52 PM
This might be a really stupid question, but if I am doing a packet trace with a VPN ip that is in use, will that make a difference? Cause when I do a packet trace from the outside interface to the inside interface using an IP that isnt in use it gives me the below result:
Pinging from 172.17.255.15 ---> 10.211.20.30 comes back allowed. TCP from 172.17.255.15 ---> 10.211.20.30 via 3389 (RDP) comes back allowed.
So should I now be able to ping and rdp to/from the Azure subnets via the Anyconnect subnets??
Thanks in advance fellas.. this one is doing head in..lol :)
... View more
Created by
virtuali1151
in Network Management
03-04-2019
03-04-2019
Hi All, For the S2S VPN tunnel bandwidth throughput does anybody know if
that total is bi-directiona...
Created by
virtuali1151
in Network Management
02-04-2019
02-04-2019
Hey Marce, Ok, any idea how to check that? And do you know the max
bandwidth of the Ipsec VPN tunnel...
02-04-2019
Hi All, Does anybody no how I can actually monitor the amount of
bandwidth my current traffic is usi...
01-31-2019
Hi there, Actually figured this out. I was missing the static route on
our GW to the Azure Tenant. O...
01-31-2019
Hi John, I suspect I am missing something with a route. I can ping/trace
as per the below it works f...
01-31-2019
Hi John, Our setup goes like this. So if I ping from my GW switch
10.1.1.1--> to the Azure Tenant De...
01-31-2019
Hello,I have a strange issue. We have some servers in Azure tenants via
a S2S VPN tunnel. I can ping...
Created by
virtuali1151
in Network Management
01-08-2019
01-08-2019
an addition to this, I have updated our Firepower modules as well. So I
am not sure if this might be...
Created by
virtuali1151
in Network Management
01-08-2019
01-08-2019
Hi All,I recently upgraded our Cisco ASA 5545 to version 9.9(2)36. Since
the upgrade we are not able...
12-14-2018
I had to change my interfaces to ANY/ANY and apply applicable subnets.
This had to be done because o...
12-13-2018
Hey Dennis,Here is some more logs...
FILTER:srcIP=10.211.20.10;dstIP=10.1.90.14;%ASA-5-305013: Asymm...
12-12-2018
I'm still getting this error: Asymmetric NAT rules matched for forward
and reverse flows; Connection...
12-11-2018
Hi Dennis, Sorry, I should have put that.. it is in the Onprem group
object. When I do the packet tr...
12-11-2018
Hi All, I am having an issue with my Azure subnets (10.210.0.0/16,
10.211.0.0/16) being able to acce...
Created by
virtuali1151
in VPN
11-20-2018
11-20-2018
This might be a really stupid question, but if I am doing a packet trace
with a VPN ip that is in us...
Public Statistics
| Date Registered | 08-09-2018 10:14 AM |
| Date Last Visited | 04-04-2019 05:25 PM |
| Total Messages Posted | 39 |
| Total Helpful Votes Received | 15 |
.jpg "VIP Advisor"){kind=icon}
