Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Waterbird
01-03-2019
Stats
Member since
09-06-2018
40
Posts
0
Helpful
0
Solutions
12-27-2018
08:38 AM
I'm using a C2960X. I enter spanning-tree mode ?. The options are: mst pvst rapid-pvst I'd like to seek some clarification on the last two options. 1. What I understand is that using this pvst command will implement a Cisco version of STP/802.1d and will indicate ieee on show span. But I suspect this is actually using pvst+, even though it says pvst. I'm assuming that pvst is no longer in use on modern Cisco switches as it can't run 802.1q trunks, but it still calls itself pvst even though it is really pvst+ that is being used. On the other hand, it seems odd that Cisco would not be able to keep track of it's own naming conventions. I understand it is common to refer to pvst+ as pvst, though technically this is incorrect, but that might explain why Cisco is calling pvst+ the incorrect name. What's really going on? 2. I understand the rapid-pvst option refers to 802.1w/rstp. I understand this will display on show span as rstp. What i'm not clear on is if this is if this is rapid-pvst or rapid-pvst+?
... View more
Labels:
12-24-2018
09:26 AM
The video was a Chris Bryant CCNA Security video on the topic of port-security.
... View more
12-24-2018
07:59 AM
What does it mean to "bounce" a switch or that the switch "bounced"? When I first heard this used I thought it meant shutting an interface down and then turning it on again, to clear a port-security violation and re-enable the port. But then I saw a training video which referred to shutting down the port and bouncing as if they were two different things. I found a lot of references to the term "bounce" in electronics as well, but not sure if that's where the term comes from. What is bouncing and is it only something you do with a switch, or is it routers too or other devices?
... View more
Labels:
12-21-2018
02:54 PM
One follow up question about your comment, where you said: "Cisco term "secure" in this context as meaning mac addresses that are successfully added by any method - static, dynamic, dynamic sticky - the port doesn't care." I noticed on a switch I have that when typing show mac-address ?, that one of the options is "secure". I found that show mac-address secure only outputted static addresses and left out all of the dynamic ones. If secure at least in the earlier context means any type, but in the show commands only means static, I'm curious if there is any way to further expand on the "secure" term and it's full range of uses and meanings in Cisco port-security terminology. One other point: I saw an instructor define aging as a way to define how long dynamically learned addresses are secure. He also notes it can be used for static as well but this is rarely done. So this seems to imply that dynamic and static addresses can be considered secure or insecure. What is an insecure mac-address? Versus a secure one?
... View more
12-18-2018
03:20 PM
The use case you mention of a switch connected to a switch or hub is a good example where you might want an aging mechanism to flush old dynamically learned addresses and as a violation prevention strategy. So in this specific use case, let's see if I can interpret what Cisco means here: "Use aging to remove secure MAC addresses on a secure port without manually deleting the existing secure MAC addresses". So in your scenario we are "using agin gto remove" the addresses without having to manually flush with a shutdown command, or manually reconfigure. I believe the aging command applies only to dynamically learned, so I guess this explains the first Cisco quotation. Let's see about the next one: "Aging time limits can also be increased to ensure past secure MAC addresses remain, even while new MAC addresses are added" I'm not sure I understand here what Cisco is getting at. Does the term "secure" MAC address refer only to static, or only to dynamic, or both? I suppose increasing aging time would allow for longer storage of past addresses, while still allowing new ones to be added, until you reach the limit.
... View more
12-17-2018
02:27 PM
I'm familiar with the switchport aging command and it's options: #switchport port-security aging {static | time time type {absolute | inactivity}} Static keyword: enables aging for statically configured secure addresses on this port Time time keyword: specifies the aging time for this port. 0 means aging is disabled Type absolute: all the secure addresses on this port age out at exactly the time specified Type inactivity: age out only if no data traffic for time period I'm having trouble understanding specific cases of when you would use this command how the command options would be used in various cases. The Cisco literature only stated the following use cases: "Use aging to remove secure MAC addresses on a secure port without manually deleting the existing secure MAC addresses Aging time limits can also be increased to ensure past secure MAC addresses remain, even while new MAC addresses are added" I have trouble grasping these use cases. I just don't understand what they are saying after reading these sentences over and over again. Can someone please expound a little?
... View more
Labels:
12-10-2018
11:02 AM
Hello. I'm trying to understand the command for configuring a pre-shared key on a ASA 5506-X. So far, I've already configured my IKE Phase 1 ISAKMP policy on an ASA. I selected the pre-share option for authentication. However, the #crypto isakmp policy 1 command was not available for some unknown reason, so I used #crypto ikev1 policy 1 instead. The next step, in my understanding for routers at least, is if using pre-share option, I should configure this: #crypto isakmp key cisco12345 address 172.30.2.2 (peer router ip address) However, I'm on an ASA not a router, not a router, and as mentioned the usual crypto isakmp policy command is gone, but there was a cyrpto ikev1 policy command I used instead. So given all of the above, what is the command I should use to configure the pre-shared key on the ASA?
... View more
Labels:
12-07-2018
02:32 PM
If Ctrl-^+x means on Windows control key, plus shift key, plus x key all at once, it didn't work for me. I'm frequently getting trapped in the firepower module unable to return the ASA without power cycling it.
... View more
12-07-2018
02:29 PM
I also occasionally have a problem exiting the firepower module and returning to the ASA. The available commands exit and logout did not help. The device it self says: Connected to module sfr. Escape character sequence is 'CTRL-^X'. I tried this (interpreting it to mean control plus shift key plus x key). The control plus shift plus 6 plus x sequence also does not work I found that I could simply unplug the ASA and it reboots into ASA mode, but that isn't very helpful if you need to go back and forth between modes configuring. I hope someone can find a solution to how to move from the firepower module back to the ASA.
... View more
- Tags:
- asa
12-07-2018
08:43 AM
Background: I'm using ASA 5506-X version 9.8.2 with FirePower module It has inside a BVI address on the inside of 192.168.2.1 /24 which gives that out to all inside interface automatically. The outside interface is connected to the internet and can ping the internet, and gets it's address by DCHP. I have a crossover cable connecting inside interface 1 (gig 1/2) to the management port. I assume no switch is needed. All these connections show as up/up What are the next steps? I tried using the ASA CLI to give the management 1/1 an IP address. I thought I would best give it 192.168.2.2. However, it gave an error: ERROR: Failed to apply IP address to interface Management1/1, as the network overlaps with interface BVI1. Two interfaces cannot be in the same subnet. I'm not sure I understand conceptually what is happening here? I then tried using ASDM, though I prefer to set this up with CLI. But when I open the Startup Wizard, I get an error: ASDM is temporarily unable to contact the firewall. I'm a bit lost as I've never done this before, and wanted to see if anyone can give me some tips on getting firepower initially configured and why I'm not able to get it to work. Thanks!
... View more
12-06-2018
01:10 PM
On ASA 5506-X version 9.8.2, I have configured NTP: NTP server x.x.x.x source outside (Where x.x.x.x is an external public NTP server ip address). I also configured timezone on the ASA as I read it should be relatively close to the NTP time, though not sure why it matters. For the internal hosts, I assumed I also need to have the ASA tell them where to find the NTP server via DHCP from the ASA. My best guess on looking at cisco documentation and searching online, is that tim server can be sent out by DHCP by using: dhcdp option 4 x.x.x.x It takes the dhcpd option 4 part, but gives an error marker at the beginning of the IP address. If I type dhcpd option 4 ?, one option is "ip configure the option information as IP address(es) after this keyword But if I type in an IP address, no matter if it is the global NTP address or even the private address of the inside interface, it doesn't work. The error is a carrot on the first number of the IP address. Furthermore, typing dhcpd option 4 x.x.x.x ? says "unrecognized command. " So what advice can you give to help me configure NTP on an ASA to use a external public NTP server so that the ASA and internal hosts know what time it is.
... View more
- Tags:
- ASA NTP
Labels:
12-06-2018
07:10 AM
This document you provided a link for was very helpful in providing an overview of the new NAT. Exactly what I was searching for. This configuration I provided is for a VPN tunnel, so it seems the first statement is identity NAT, which is a variation of Twice NAT / Manual NAT, in Section 1. It's purpose appears to be to not do NAT for the traffic from the first object group to the second object group or backwards, i.e. "no NAT for either source or destination networks". The second NAT statement appears to be dynamic PAT, implemented using Twice NAT / Manual NAT, in Section 3, and must serve to NAT traffic that is not contained in the object groups.
... View more
Please explain this configuration. What kind of NAT is it using and how can I learn how to configure it? nat(any,outside) source static OBJECT-GROUP-1 OBJECT-GROUP-1 destination static OBJECT-GROUP-2 OBJECT-GROUP-2 no-proxy-arp route-lookup nat(any,outside) after-auto source dynamic any interface
... View more
Labels:
12-05-2018
08:37 AM
I see in the object-group configs there is a network object group that includes the private address referenced in ssh as the RFC1918 address. This object-group is mapped to the device by an IPsec VPN tunnel. So I suppose this would allow SSH on inside devices to go through the tunnel instead of through the unprotected internet.
... View more
Created by
Waterbird
in VPN and AnyConnect
in VPN and AnyConnect
12-05-2018
08:31 AM
12-05-2018
08:31 AM
I need more clarity on how the sequence numbers work. For example, if you have 2 crypto maps on a device that have the same crypto map name, but different sequence numbers, how would that work, say versus 2 crypto maps on the device with different crypto map names, but different sequence numbers, or as a third case, 2 crypto map names on a device with different crypto map names and the same sequence numbers.
... View more
12-27-2018
I'm using a C2960X. I enter spanning-tree mode ?. The options
are:mstpvstrapid-pvst I'd like to seek...
12-24-2018
What does it mean to "bounce" a switch or that the switch "bounced"?
When I first heard this used I ...
12-21-2018
One follow up question about your comment, where you said: "Cisco term
"secure" in this context as m...
12-18-2018
The use case you mention of a switch connected to a switch or hub is a
good example where you might ...
12-17-2018
I'm familiar with the switchport aging command and it's options:
#switchport port-security aging {st...
12-10-2018
Hello. I'm trying to understand the command for configuring a pre-shared
key on a ASA 5506-X. So far...
12-07-2018
Saving your changes:For an ASA with firepower services, if you make a
change to firepower CLI config...
12-07-2018
If Ctrl-^+x means on Windows control key, plus shift key, plus x key all
at once, it didn't work for...
Public Statistics
| Date Registered | 09-06-2018 03:12 PM |
| Date Last Visited | 01-03-2019 09:21 AM |
| Total Messages Posted | 40 |
Helpful Votes Given To
.jpg "VIP Advocate"){kind=icon}
