Hi Justin, My suggestion is to append the "extendable" command to the end of your static NAT entry. ip nat inside source static tcp 10.1.10.11 80 70.91.###.157 80 extendable Regards, Leon ... View more

All software configuration guides and command references can be found on Cisco Documentation Site <http://www.cisco.com/univercd/home/home.htm> This link will take you to the Cataylst 3750 Software Configuration Guide for release 12.2(25)SEE, "Working with the Cisco IOS File System, Configuration Files, and Software Images" section. http://www.cisco.com/univercd/cc/td/doc/product/lan/cat3750/12225see/scg/swiosfs.htm#wp1017927 Good luck with upgrading. HTH --Leon * Please rate ALL posts. ... View more

If you have two servers that need to be available from the outside on port 80, you'll need two public IP addresses. In case of webservers serving the same content you can use various features such as slb to load balance between servers. Another non-Cisco option is to use an ISA server for reverse-proxy. The simplest option is to request a routed subnet from your service provider. It shouldn't be that hard to obtain a /29 address allocation. HTH --Leon * Please rate ALL posts. ... View more

WIC-1ENET is not supported on 2600-series. There are no NM options either. You can however create sub-interfaces and use a switch to create multiple segments. HTH --Leon * Please rate ALL posts. ... View more

HSRP forwards all IP traffic. I can't help you without configuration details. Please post your configuration. --Leon ... View more

Use a different pool for VPN Clients. Use the configuration below as a reference; version 12.3 service timestamps debug datetime msec service timestamps log datetime msec service password-encryption ! hostname Router ! no logging on ! username gfullage password 7 0201024E070A0E2649 aaa new-model ! ! aaa authentication login clientauth local aaa authorization network groupauthor local aaa session-id common ip subnet-zero ! ! no ip domain lookup ! ! !--- Keyring that defines wildcard pre-shared key. crypto keyring spokes pre-shared-key address 0.0.0.0 0.0.0.0 key cisco123 ! crypto isakmp policy 10 encr 3des authentication pre-share group 2 ! !--- VPN Client configuration for group "testgroup" !--- (this name is configured in the VPN Client). crypto isakmp client configuration group testgroup key cisco321 dns 1.1.1.1 2.2.2.2 wins 3.3.3.3 4.4.4.4 domain cisco.com pool ippool ! !--- Profile for VPN Client connections, that matches !--- the "testgroup" group and defines the Xauth properties. crypto isakmp profile VPNclient description VPN clients profile match identity group testgroup client authentication list clientauth isakmp authorization list groupauthor client configuration address respond ! ! crypto ipsec transform-set myset esp-3des esp-sha-hmac ! !--- Two instances of the dynamic crypto map !--- reference the two previous IPsec profiles. crypto dynamic-map dynmap 5 set transform-set myset set isakmp-profile VPNclient ! ! !--- Crypto-map only references the !--- instances of the previous dynamic crypto map. crypto map mymap 10 ipsec-isakmp dynamic dynmap ! ! ! interface FastEthernet0/0 description Outside interface ip address 10.48.67.181 255.255.255.224 no ip mroute-cache duplex auto speed auto crypto map mymap ! interface FastEthernet0/1 description Inside interface ip address 10.1.1.1 255.255.254.0 duplex auto speed auto no keepalive ! ip local pool ippool 10.5.5.1 10.5.5.254 no ip http server no ip http secure-server ip classless ip route 0.0.0.0 0.0.0.0 10.48.66.181 ! ! call rsvp-sync ! ! dial-peer cor custom ! ! line con 0 exec-timeout 0 0 escape-character 27 line aux 0 line vty 0 4 password 7 121A0C041104 ! ! end HTH --Leon * Please rate ALL posts. ... View more

Hello Jack, Since the router is stuck in exstart stage, I suspect MTU. However the MTU of both systems match, I have seen adjacencies between Cisco switches and routers fail because of this. Try thee ip ospf ignore-mtu interface command, and see what happens. Also try to disable link-local signalling between non-cisco devices with the ip ospf lls disable interface command. This is recommended in case the device is not in compliance with RFC 2328. HTH --Leon * Please rate ALL posts. ... View more

You need to be more specific. In general with 802.1W a spanning-tree topology change would not disrupt your network. If you have taken appropriate precautions to protect your root bridge against unintended root elections you should not suffer outages, especially not through the entire network. When a change in the topology occurs, directly attached links will flush their CAM tables. This will result in unicast flooding, until the switch re-learns mac-addresses from all active systems. If that switch, which was rebooted is directly connected to the core switch, it could result in flushing CAMs. No big deal for a 6509. Track the source of the TCN by issuing "show spanning-t vlan x detail. See from what port the last topology change was sourced. If you want to find the problem, try to reboot after working hours and see if you can simulate the same effects. Then you can enable debugging on intermediate switches to see what happens. Please check if your current software has reported bugs regarding spanning-tree. This has been my experience in the past with Rapid PVST problems. HTH --Leon * Please rate ALL posts. ... View more

Cinzia, An underrun is when the transmitter runs at a higher rate than the packets sent to the hardware buffer. This is when the packets are going out faster than the hardware buffer can send them, just the opposite of an overrun. Can you provide output of the "show buffers" command? If you have access to CCO you can use output interpreter to run analysis on your buffers. Does this switch serve an other purpose opposed to the others in your networ. I.e. does it house servers or is it an distribution point of any kind? That is interesting to know. HTH --Leon * Please rate ALL posts. ... View more

Each EtherChannel can consist of up to eight compatibly configured Ethernet ports. All ports in each EtherChannel must be configured as either Layer 2 or Layer 3 ports. The number of EtherChannels is limited to 48. However, this may vary between platforms. HTH --Leon * Please rate ALL posts. ... View more

You can't copy a tar zipped archive to flash. Aside from the obove mentioned, you need to do the following; display the contents of the tar (i.e. is the archive valid) archive tar /table tftp://10.194.1.1/c3750-ipbase-tar.122-25.SEE2.tar unpack the tar to flash and keep the previous software for roll-back archive download-sw /leave-old-sw /reload tftp://10.194.1.1/c3750-ipbase-tar.122-25.SEE2.tar HTH --Leon * Please rate ALL posts. ... View more

I noticed the same overruns and got stuck in my search for information. Here is my initial post on the matter: http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40.1ddc07e0 --Leon ... View more

You can use the storm-control feature on the C2950 to trace the source of the broacasts and optionally close the affected port(s). If your LAN performance is affected by these broadcasts, I suggest you solve the problem at the source rather than on the switch. Please refer to the following document: http://www.cisco.com/univercd/cc/td/doc/product/lan/cat2950/12122ea5/2950scg/swtrafc.htm#wp1063295 HTH --Leon * Please rate ALL posts. ... View more