Hi All,   I am having this issue with one of our customer. The router one is not showing the correct next-hop address as compare to router two.   CE1--eBGP-->PE1                            |iBGP CE2--eBGP-->PE2   The existing config is as follows PE1 ===== interface Loopback1  description NAT address for web traffic  ip address 192.168.1.20 255.255.255.255 ! interface GigabitEthernet0/1  description B2B interface  ip address 35.5.111.69 255.255.255.252  duplex full  speed 100 ! interface Serial1/0.3 point-to-point  description PVC to CustomerA  bandwidth 500  ip address 36.6.66.118 255.255.255.252  ip nat inside   ! router bgp 65120  no synchronization  bgp log-neighbor-changes  neighbor 35.5.111.70 remote-as 65120  neighbor 35.5.111.70 description IBGP to backup router  neighbor 35.5.111.70 next-hop-self  neighbor 35.5.111.70 soft-reconfiguration inbound  neighbor 36.6.66.117 remote-as 13009  neighbor 36.6.66.117 description customerA  neighbor 36.6.66.117 soft-reconfiguration inbound  neighbor 36.6.66.117 route-map HOST out  neighbor 36.6.66.117 filter-list 1 in ! ip as-path access-list 1 deny _64500_ ip as-path access-list 1 permit .* ! ip nat inside source list 11 interface Loopback1 overload ! ip access-list standard HOST  permit 210.11.66.244   ! access-list 11 permit ip 10.0.0.0 0.255.255.255 host 210.11.66.244 ! route-map HOST-HOST permit 10  match ip address HOST  set as-path prepend 64500 64500 ! route-map HOST-HOST deny 20 ! PE2 ====== interface Loopback1  description NAT address for web traffic  ip address 192.168.1.21 255.255.255.255 ! interface GigabitEthernet0/1  description B2B interface  ip address 35.5.111.70 255.255.255.252  duplex full  speed 100 ! interface Serial1/0.3 point-to-point  description PVC to CustomerA  bandwidth 500  ip address 36.6.66.122 255.255.255.252  ip nat inside   ! router bgp 65120  no synchronization  bgp log-neighbor-changes  neighbor 35.5.111.69 remote-as 65120  neighbor 35.5.111.69 description IBGP to backup router  neighbor 35.5.111.69 next-hop-self  neighbor 35.5.111.69 soft-reconfiguration inbound  neighbor 36.6.66.121 remote-as 13009  neighbor 36.6.66.121 description customerA  neighbor 36.6.66.121 soft-reconfiguration inbound  neighbor 36.6.66.121 route-map HOST out  neighbor 36.6.66.121 filter-list 1 in ! ip as-path access-list 1 deny _64500_ ip as-path access-list 1 permit .* ! ip nat inside source list 11 interface Loopback1 overload ! ip access-list standard HOST  permit 210.11.66.244   ! access-list 11 permit ip 10.0.0.0 0.255.255.255 host 210.11.66.244 ! route-map HOST-HOST permit 10  match ip address HOST  set as-path prepend 64500 64500 ! route-map HOST-HOST deny 20 ! The intended result is as follows as showing from router two PE1# show ip bgp | in 10.16 *i10.16.0.0/16    35.5.111.70          0   100  0 13009 65000 i  Router PE1 is showing the next-hop as the iBGP neighbor. PE2# show ip bgp | in 10.16 *>10.16.0.0/16    36.6.66.121          0   100  0 13009 65000 i  This is a correct path for te customer.   I think the customer connection issue will resolve if we can correct the routing in PE1 like as below PE1# show ip bgp | in 10.16 *>10.16.0.0/16    36.6.66.117          0   100  0 13009 65000 i  What is required to correct it on PE1/PE2? Please advice. ... View more

Hi All,   I am having this issue with one of our customer. The router one is not showing the correct next-hop address as compare to router two.   CE1---->PE1 CE2---->PE2   The existing config is as follows PE1 ===== interface Loopback1  description NAT address for web traffic  ip address 192.168.1.20 255.255.255.255 ! interface GigabitEthernet0/1  description xxxx  ip address x.5.111.69 255.255.255.252  duplex full  speed 100 ! interface Serial1/0.3 point-to-point  description PVC to CustomerA  bandwidth 500  ip address y.6.66.118 255.255.255.252  ip nat inside   ! router bgp 65120  no synchronization  bgp log-neighbor-changes  neighbor x.5.111.70 remote-as 65120  neighbor x.5.111.70 description IBGP to backup router  neighbor x.5.111.70 next-hop-self  neighbor x.5.111.70 soft-reconfiguration inbound  neighbor y.6.66.117 remote-as 13009  neighbor y.6.66.117 description customerA  neighbor y.6.66.117 soft-reconfiguration inbound  neighbor y.6.66.117 route-map HOST out  neighbor y.6.66.117 filter-list 1 in ! ip as-path access-list 1 deny _64500_ ip as-path access-list 1 permit .* ! ip nat inside source list 11 interface Loopback1 overload ! ip access-list standard HOST  permit 210.11.66.244   ! access-list 11 permit ip 10.0.0.0 0.255.255.255 host z.11.66.244 ! route-map HOST-HOST permit 10  match ip address HOST  set as-path prepend 64500 64500 ! route-map HOST-HOST deny 20 ! PE2 ====== interface Loopback1  description NAT address for web traffic  ip address 192.168.1.21 255.255.255.255 ! interface GigabitEthernet0/1  description xxx  ip address x.5.111.70 255.255.255.252  duplex full  speed 100 ! interface Serial1/0.3 point-to-point  description PVC to CustomerA  bandwidth 500  ip address y.6.66.122 255.255.255.252  ip nat inside   ! router bgp 65120  no synchronization  bgp log-neighbor-changes  neighbor x.5.111.69 remote-as 65120  neighbor x.5.111.69 description IBGP to backup router  neighbor x.5.111.69 next-hop-self  neighbor x.5.111.69 soft-reconfiguration inbound  neighbor y.6.66.121 remote-as 13009  neighbor y.6.66.121 description customerA  neighbor y.6.66.121 soft-reconfiguration inbound  neighbor y.6.66.121 route-map HOST out  neighbor y.6.66.121 filter-list 1 in ! ip as-path access-list 1 deny _64500_ ip as-path access-list 1 permit .* ! ip nat inside source list 11 interface Loopback1 overload ! ip access-list standard HOST  permit z.11.66.244 ! access-list 11 permit ip 10.0.0.0 0.255.255.255 host z.11.66.244 ! route-map HOST-HOST permit 10  match ip address HOST  set as-path prepend 64500 64500 ! route-map HOST-HOST deny 20 ! The intended result is as follows as showing from router two PE1# show ip bgp | in 10.16 *i10.16.0.0/16    x.5.111.70          0   100  0  13009 65000 i  PE2# show ip bgp | in 10.16 *>10.16.0.0/16    y.6.66.121          0   100  0  13009 65000 i    I think the customer connection issue will resolve if we can correct the routing in PE1 like as below PE1# show ip bgp | in 10.16 *>10.16.0.0/16    y.6.66.117          0   100  0  13009 65000 i    What is required to correct it? Please advice. ... View more

We are currently running NX-OS 5.1(3) The issue is as follows, both Boxs are connected to SW1 Box1 = 10.10.20.20 Box1 = 10.10.40.20   Sw1= 10.10.20.3 Active HSRP, DGW 10.10.20.1 Sw1= 10.10.40.3 Active HSRP, DGW 10.10.40.1 Sw2= 10.10.20.2 Standby HSRP, DGW 10.10.20.1 Sw2= 10.10.40.2 Standby HSRP, DGW 10.10.40.1   when Box1 (10.10.20.20) Traceroute to Box2(10.10.40.20) it uses the next-hop as 10.10.20.3(=Active HSRP IP of SW1) But when Box2 (10.10.40.20) Traceroute to Box1(10.10.20.20) it uses the next-hop as 10.10.40.2(=Standby HSRP IP of SW2) WHY? Can anyone help me out? ... View more

we are current running 5.1(3) NX-OS The senario is as follows Both servers are connected to SW1 Box1 = 10.10.20.20 VLAN 20 Box2 = 10.10.40.20 VLAN 40   SW1= 10.10.20.3 HSRP Active GW 10.10.20.1 SW2= 10.10.20.2 HSRP Standby GW 10.10.20.1 SW1= 10.10.40.3 HSRP Active GW 10.10.40.1 SW2= 10.10.40.2 HSRP Standby GW 10.10.40.1   From Box1(10.10.20.20) trying to traceroute Box2 (10.10.40.20); the tracroute is showing the next-hope as 10.10.20.3 (SW1 IP as HSRP Active) But From Box2(10.10.40.20) trying to traceroute Box1 (10.10.20.20); the tracroute is showing the next-hope as 10.10.40.2 (SW2 IP as HSRP Standby)   Why the communication between Box2 to Box1 is using the HSRP standby IP of SW2 to reach its destination? ... View more

Hi All, I am trying to design a template for a new data center using Nexus platform. I am having trouble to finalize the suitable dynamic routing protocol can be used. My design is attached here. My question 1) I am using eBGP to ISP and iBGP between ASR pairs, any comments? 2) What would be the best Dynamic routing protocol to use between ASR and ASA to redistribute the route or default route from BGP into this Dynamic routing protocol 3) I am planniing to use OSPF between ASA Inside network and Nexus L3 domain, any comments? Advance thanks for your help. Tabassum ... View more

Hi All, I have a NAT setup. Some of my udp packets are dropping. How to find more about the NAT to find whether it missed anything or not. the router is 3945e. 1000#sh ip nat statistics Total active translations: 1392 (17 static, 1375 dynamic; 1375 extended) Peak translations: 3839, occurred 1d19h ago Outside interfaces:   GigabitEthernet0/1 Inside interfaces:   GigabitEthernet0/0 Hits: 232411493  Misses: 0 CEF Translated packets: 112178990, CEF Punted packets: 5643880 Expired translations: 61476 Dynamic mappings: -- Inside Source [Id: 1] access-list 110 interface Loopback0 refcount 2110 Total doors: 737 Appl doors: 0 Normal doors: 737 Queued Packets: 0 ... View more

Hi All, I am having issues with the ASA 5510 management interface. I can't communicate with this interface. It is showing DOWN/DWON evenif I type NO SHUT several times. My existing config is as follows our-asa-01# sh run : Saved : ASA Version 7.2(5) ! hostname our-asa-01 names dns-guard ! interface Ethernet0/0 nameif outside security-level 0 ip address x.x.x.2 255.255.255.0 ! interface Ethernet0/1 shutdown no nameif no security-level no ip address ! interface Ethernet0/2 nameif pro security-level 100 ip address 10.10.10.2 255.255.255.0 ! interface Ethernet0/3 shutdown no nameif no security-level no ip address ! interface Management0/0 duplex full nameif management security-level 0 ip address 10.10.99.11 255.255.255.0 management-only ! boot system disk0:/asa725-k8.bin no ftp mode passive dns server-group DefaultDNS domain-name tmi-our.local same-security-traffic permit inter-interface same-security-traffic permit intra-interface access-list outside_access_in extended permit icmp any any access-list outside_access_in extended permit tcp any any eq https access-list outside_access_in extended deny ip any any access-list management_access_in extended permit ip any any pager lines 24 logging enable logging asdm informational mtu outside 1500 mtu production 1500 mtu management 1500 no failover icmp unreachable rate-limit 1 burst-size 1 asdm image disk0:/asdm-525.bin no asdm history enable arp timeout 14400 global (outside) 1 interface nat (pro) 1 0.0.0.0 0.0.0.0 no threat-detection statistics tcp-intercept access-group outside_access_in in interface outside access-group management_access_in in interface management route outside 0.0.0.0 0.0.0.0 x.x.x.x 1 route pro 172.16.0.0 255.255.255.0 10.10.10.1 1 route management 0.0.0.0 0.0.0.255 10.10.99.1 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 http server enable http 10.10.99.100 255.255.255.255 management no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart crypto ipsec security-association lifetime seconds 28800 crypto ipsec security-association lifetime kilobytes 4608000 telnet timeout 5 ssh 10.10.99.0 255.255.255.0 management ssh timeout 30 ssh version 2 console timeout 30 management-access management tftp-server management 10.10.99.100 t ftp://10.10.99.100/ username manager password w8DyJk5xISyQAabZ encrypted privilege 15 ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns migrated_dns_map_1 parameters   message-length maximum client auto   message-length maximum 512 policy-map global_policy class inspection_default   inspect dns migrated_dns_map_1   inspect ftp   inspect h323 h225   inspect h323 ras   inspect rsh   inspect rtsp   inspect esmtp   inspect sqlnet   inspect skinny   inspect sunrpc   inspect xdmcp   inspect sip   inspect netbios   inspect tftp   inspect icmp ! service-policy global_policy global prompt hostname context Cryptochecksum:953f4b1927ba125e6e585da372f0b0df : end our-asa-01# sh int ip br Interface                  IP-Address      OK? Method Status                Protocol Ethernet0/0                x.x.x.2        YES CONFIG up                    up Ethernet0/1                unassigned      YES unset  administratively down up Ethernet0/2                10.10.10.2      YES CONFIG up                    up Ethernet0/3                unassigned      YES unset  administratively down up Internal-Control0/0        127.0.1.1       YES unset  up                    up Internal-Data0/0           unassigned      YES unset  up                    up Management0/0              10.10.99.11     YES manual down                  down our-asa-01# sh int m0/0 Interface Management0/0 "management", is down, line protocol is down   Hardware is i82557, BW 100 Mbps         Full-Duplex, Auto-Speed         MAC address c84c.75ea.2bc7, MTU 1500         IP address 10.10.99.11, subnet mask 255.255.255.0         0 packets input, 0 bytes, 0 no buffer         Received 0 broadcasts, 0 runts, 0 giants         0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort         0 L2 decode drops         0 packets output, 0 bytes, 0 underruns         0 output errors, 0 collisions, 0 interface resets         0 babbles, 0 late collisions, 0 deferred         0 lost carrier, 0 no carrier         0 input reset drops, 0 output reset drops         input queue (curr/max packets): hardware (0/0) software (0/0)         output queue (curr/max packets): hardware (0/0) software (0/0)   Traffic Statistics for "management":         0 packets input, 0 bytes         0 packets output, 0 bytes         0 packets dropped       1 minute input rate 0 pkts/sec,  0 bytes/sec       1 minute output rate 0 pkts/sec,  0 bytes/sec       1 minute drop rate, 0 pkts/sec       5 minute input rate 0 pkts/sec,  0 bytes/sec       5 minute output rate 0 pkts/sec,  0 bytes/sec       5 minute drop rate, 0 pkts/sec our-asa-01# ping 10.10.99.11 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.10.99.11, timeout is 2 seconds: ??? Success rate is 0 percent (0/3) our-asa-01# ping Interface: management Target IP address: 10.10.99.11 Repeat count: [5] Datagram size: [100] Timeout in seconds: [2] Extended commands [n]: Sweep range of sizes [n]: Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.10.99.11, timeout is 2 seconds: Error: management interface is shutdown Success rate is 0 percent (0/1) ... View more

Hi, I have an issue in the Cisco PIx 515e series. The IOS is 6.1(2). I have set sepecific access-list to allow incoming traffic to inside interface. But still the TCP 3-way handshaking is dropped here. 302001: Built inbound TCP connection 11959955 for faddr 135.86.1.203/2525 gaddr 125.52.207.71/9300 laddr 10.5.2.14/9300 302002: Teardown TCP connection 11959955 faddr 135.86.1.203/2525 gaddr 125.52.207.71/9300 laddr 10.5.2.14/9300 duration 0:00:00 bytes 0 (TCP Reset-I) nameif ethernet0 outside security0 nameif ethernet2 dmz1 security40 ip address outside 125.52.207.3 255.255.255.0 ip address dmz1 10.5.2.100 255.255.255.0 access-list acl_out permit tcp host 135.86.1.203 host 135.52.207.71 eq 9300 static (dmz1,outside) 135.52.207.72 10.5.2.14 netmask 255.255.255.255 0 0 access-group acl_out in interface outside route outside 0.0.0.0 0.0.0.0 125.52.207.1 1 Thx. tabassum ... View more