I start out with three VIRL switches connected together in a triangle configuration by trunk links.  All links are 1 Gbps links, set to auto.  STP performs as expected.    I then change the link speed between one of the switches by turning off auto negotiation, and then forcing the link speed to 10 Mbps.  STP again performs as expected, changing the path cost to 100 for that link, and changing the location of the blocking port.    Then I remove the link speed (no speed 10) on both switch interfaces for the link, and turn auto back on (no speed 10; negotiation auto).  I verify the change back to speed auto has occurred on each interface.  At this point STP behaves unexpectedly.  Show spanning-tree vlan 1 still shows the path cost at 100.  The BLK port does not move back.    I have tried: waiting removing the physical cable and putting a new on in   Not quite understanding why STP is not automatically updating itself in this situation.  Any ideas?   ... View more

I have questions about basic static NAT configuration.    I have a host inside a DMZ and I want an outside host to be able to reach it.   I understand this is a typical scenario in which static NAT would be used, such as if you had a server in a DMZ that outside hosts need to access.     I'm using the following configuration:   object network WEB-OUTSIDE      host 192.168.122.122    object network WEB-INSIDE      host 11.1.1.2       nat (dmz,outside) static WEB-OUTSIDE     The 11.1.1.2 host in the host in the DMZ.  I've set it to NAT to  192.168.122.122, which I'm using to represent a global IP  address for lab purposes.    The outside host is 192.168.122.196 /24, and is directly connected, through a layer 2 switch, to the ASA outside interface.   The ASA outside interface is 192.168.122.121 /24.   My basic questions are: 1.  Is it correct, as I have done, to assign the global IP address of 192.168.122.122, which is not assigned to any host or interface, as the mapped address in the NAT configuration?  Or am I supposed to use the outside interface address on the ASA, which is 192.168.122.121?  I'm assuming since it is a server it should get it's on global IP address, and that this global IP address should not need to be assigned to any interface at all.   2. When I ping from the host on the outside Network to the host in the DMZ, am I supposed to ping the global IP address, 192.168.122.122, or the real IP address, 11.1.1.2?  I'm using the latest ASAv image.  It makes sense to me to use the global IP address, but want to confirm my understanding.   3.  Is this NAT configuration sufficient, or does there need to be another NAT statement to let traffic go the other way?   ... View more

This is an ASA access list question. Why am I not able to ping the host in the DMZ from the host in the OUTSIDE? I have ACL's configured to allow ICMP, so not sure what I'm missing here.     ... View more

Hi,   I'm attempting to configure an ASA so that it can ping the internet.  It is able to ping 8.8.8.8, but not google.com.  I get an invalid hostname error instead.  Here are the configs I have on the ASA.  Can anyone help me figure out what is wrong with my config?   -------- show run | redirect config1.cfg -------- : Saved : :  : Hardware: ASAv, 2048 MB RAM, CPU Pentium II 2112 MHz : ASA Version 9.9(2) ! hostname ciscoasa enable password $ names ! interface GigabitEthernet0/0 nameif outside security-level 0 ip address dhcp setroute ! interface GigabitEthernet0/1 nameif inside security-level 100 ip address 10.1.1.254 255.255.255.0 ! interface GigabitEthernet0/2 shutdown no nameif no security-level no ip address ! interface GigabitEthernet0/3 nameif DMZ security-level 50 ip address 11.1.1.1 255.255.255.0 ! interface GigabitEthernet0/4 shutdown no nameif no security-level no ip address ! interface GigabitEthernet0/5 shutdown no nameif no security-level no ip address ! interface GigabitEthernet0/6 shutdown no nameif no security-level no ip address ! interface Management0/0 shutdown no nameif no security-level no ip address ! ftp mode passive dns domain-lookup outside dns server-group DefaultDNS name-server 8.8.8.8 name-server 8.8.4.4 pager lines 23 mtu outside 1500 mtu inside 1500 mtu DMZ 1500 no failover no monitor-interface service-module icmp unreachable rate-limit 1 burst-size 1 no asdm history enable arp timeout 14400 no arp permit-nonconnected arp rate-limit 8192 ! nat (inside,outside) after-auto source dynamic any interface route outside 0.0.0.0 0.0.0.0 192.168.122.1 1 timeout xlate 3:00:00 timeout pat-xlate 0:00:30 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 timeout floating-conn 0:00:00 timeout conn-holddown 0:00:15 timeout igp stale-route 0:01:10 user-identity default-domain LOCAL aaa authentication login-history http server enable http 0.0.0.0 0.0.0.0 inside no snmp-server location no snmp-server contact crypto ipsec security-association pmtu-aging infinite crypto ca trustpoint _SmartCallHome_ServerCA no validation-usage crl configure crypto ca trustpool policy auto-import crypto ca certificate chain _SmartCallHome_ServerCA certificate ca  quit telnet timeout 5 ssh stricthostkeycheck ssh timeout 5 ssh version 2 ssh key-exchange group dh-group1-sha1 console timeout 0 console serial dhcpd dns 8.8.8.8 dhcpd lease 7200 ! dhcpd address 10.1.1.2-10.1.1.200 inside dhcpd enable inside ! dhcpd address 11.1.1.2-11.1.1.200 DMZ dhcpd enable DMZ ! threat-detection basic-threat threat-detection statistics access-list no threat-detection statistics tcp-intercept dynamic-access-policy-record DfltAccessPolicy username david password $sha512$5000$FqXqPq44RuGzFwx/Exgs6Q==$bjfoKmtW7VjkyVYdxcfUgw== pbkdf2 privilege 15 ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns migrated_dns_map_1 parameters message-length maximum client auto message-length maximum 512 no tcp-inspection policy-map global_policy class inspection_default inspect dns migrated_dns_map_1 inspect ftp inspect h323 h225 inspect h323 ras inspect ip-options inspect netbios inspect rsh inspect rtsp inspect skinny inspect esmtp inspect sqlnet inspect sunrpc inspect tftp inspect sip inspect xdmcp inspect icmp policy-map type inspect dns migrated_dns_map_2 parameters message-length maximum client auto message-length maximum 512 no tcp-inspection ! service-policy global_policy global prompt hostname context no call-home reporting anonymous call-home profile CiscoTAC-1 no active destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address email callhome@cisco.com destination transport-method http subscribe-to-alert-group diagnostic subscribe-to-alert-group environment subscribe-to-alert-group inventory periodic monthly subscribe-to-alert-group configuration periodic monthly subscribe-to-alert-group telemetry periodic daily profile License destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService destination transport-method http Cryptochecksum:683a580941a05b1514c5d1a4a74c288d : end       ... View more

Hello. I'm attempting to configure the ASA in the GNS3 topology show below.  I was able to set up the ASA as a DHCP server to configure the computer, so the inside network appears to be configured correctly.  However, I'm not able to ping google.com or 8.8.8.8 from the ASA.    The NAT node in the diagram is supposed to provide DHCP services.  I configured the ASA's interface gig 0/0 to receive it's IP addressing from DHCP using this command.  It worked, and received an address from the NAT node's pool. ip address dhcp I'm assuming, then, that I'm missing some additional configurations on the ASA to make the ASA act as a DCHP client for other things like DNS and the default gateway, which I assume will be sent also by the NAT node once the ASA is configured correctly. I've reviewed the ASA DHCP documentation but only found information there on DHCP server configuration, but nothing on DHCP client configuration for the ASA itself. I also reviewed the GNS3 NAT node documentation and found nothing about what the default gateway address is, or anything that would help me manually configure this.    I've posted the commands I've so far entered in the ASA.  Please advise as to what I'm missing here.  Thanks! ... View more

I'm using a C2960X.  I enter spanning-tree mode ?.  The options are: mst pvst rapid-pvst   I'd like to seek some clarification on the last two options.    1.  What I understand is that using this pvst command will implement a Cisco version of STP/802.1d and will indicate ieee on show span.  But I suspect this is actually using pvst+, even though it says pvst.  I'm assuming that pvst is no longer in use on modern Cisco switches as it can't run 802.1q trunks, but it still calls itself pvst even though it is really pvst+ that is being used.  On the other hand, it seems odd that Cisco would not be able to keep track of it's own naming conventions.  I understand it is common to refer to pvst+ as pvst, though technically this is incorrect, but that might explain why Cisco is calling pvst+ the incorrect name.  What's really going on?   2.  I understand the rapid-pvst option refers to 802.1w/rstp.  I understand this will display on show span as rstp. What i'm not clear on is if this is if this is rapid-pvst or rapid-pvst+?     ... View more