Hi All, This is a weird issue. Please see exact description below: One site has its main phone number as 90xx xxxx, this site complains that random people call back on the main phone number and inform that they had received a call from this number and they are returning the call. The site manager says that this happens when anybody from other sites call external phone numbers which instead of displaying the actual number somehow displays the 90xxxxxx on the mobile screen. I checked the translation rules on the voice gateway and uccx and do not see any such masking or translation rule in place. Also testing shows that the receiver mobile displays the correct phone number and looks like the issue is random. Does this mean that somebody might have duplicated the site number and turned the number for rogue usage ? How to go about this ?
... View more
Hi All, I am trying to understand the voice translation rules and have got confused with complex usage of it. Below are some patterns : /.*\(...\)$/ /8\1/ ---- My understanding - This means any number being dialed is prefixed by 8 followed by the 3 digits that form set 1 /^8\(...\)$/ /0290838\1/ --- My understanding - This means any number starting with 8 and followed by any 3 digits gets replaced by 0290838 followed by the 3 digits that form set 1 /.+/ /00011\0/ type international international ---- In this i am unable to understand the variable "TYPE" - how is the number identified as international here for the rule match to happen ?
... View more
Hi All, I need to setup a solution where a set of CCTV cameras are within the private vlan (internal) but needs to be accessible by a 3rd party vendor from outside the network over internet. How to achieve this ? Is it just by putting an access-list for permitting an ip subnet from which the vendor would access it ? OR does this need some sort of VPN solution ? Note : The internet traffic goes through a firewall (which has the typical trust, untrust, dmz zones etc) and vlan falls under trust zone. Please guide.
... View more
Thanks Andrew for replying. Bit confused. The same set of AP's are present under AP group per site and also under flexconnect group. For the AP group i checked the following tabs : WLANS -> ADVANCED - AP GROUPS For the flexconnect i checked the following tabs : WIRELESS -> FLEXCONNECT GROUPS -> GENERAL -> FLEXCONNECT AP'S So if add the new WLAN for the AP groups then will there be any "Unsync" issues in the flexconnect groups ? Or will it automatically show up under the "WLAN - VLAN MAPPING" tab on the respective flexconnect group ? Thanks
... View more
Hi All, I need to broadcast a specific ssid at all sites. Following are the existing factors: > There is a WLAN already setup with that name and has proper configuration > There is corresponding WLAN - VLAN mapping for this SSID Some site AP's are grouped under specific flex-connect groups while other sites do not have such flex-connect groups. Do i just go to each flexconnect group -> wlan vlan mapping and click "ADD" ? Also i need to hide this SSID ? How to achieve this without any downtime ? Thanks
... View more
Hi, I am unable to add two statements to an existing access list. I do understand that the ip's 10.2.22 and 10.2.21 are part of the already allowed subnet 10.0.0.0 but i need to remove statement 40 while adding statement 60 and 70. But if i remove statement 40 first then i will loose mgmt access to the switch. This access list is applied to VTY lines. How to go about this ? Details are below: STATEMENTS TO BE ADDED: 60 Permit 10.2.22.151 0.0.0.0 70 Permit 10.2.21.248 0.0.0.0 no 40 permit 10.0.0.0 0.255.255.255 deny ip any any EXISTING ACCESS LIST: Standard IP access list MGMT_ACCESS 10 deny 10.3.200.0, wildcard bits 0.0.3.255 20 permit 192.15.14.0, wildcard bits 0.0.1.255 (168 matches) 30 permit 192.15.16.0, wildcard bits 0.0.1.255 40 permit 10.0.0.0, wildcard bits 0.255.255.255 (1456 matches) 50 permit 192.168.100.0, wildcard bits 0.0.0.255
... View more
Hi All, All the internet traffic that egress from the exit point gets source-natted to the public ip on the interface having the ISP link. Now, if the source-nat on the interface is turned off then many applications stop working or being accessible. There is no such specific configuration on the firewall for those applications. I am unable to understand this dependency of internal traffic need of being mapped to public ip for accessing certain applications for example teamviewer etc ? Is there any white-listing that the service provider needs to do on his end ? Note : When the source-nat is removed the internal private ip's (user vlan) go out without any NAT. The reason of switching off the NAT is to make the individual sites (subnets) visible to the Zscaler, as the user traffic first goes to the Zscaler for policy checks and then gets redirected to their destinations. There is no nat on the Zscaler. Thanks
... View more
Hi Andre, That has been checked to fine at the switch end and seemingly the issue is on the server. Nevertheless thanks for your comments.
... View more
Hi Deepak, Thanks for the suggestions, Point 1 is checked but the other points on server side is not checked as the server is inaccessible from any of its management ports idrac, console etc... Anyway have reached out to the server vendor for tech to come in to check settings from server perspective. Thanks
... View more
The server LAN port is trunk as it needs to carry two vlans hence the trunk on switch side , while the WAN port is access port for a single vlan. The working server on the same switch has exactly same port level configuration. The only fact to check is the settings at the server level which is not even responding to pings when the laptop is connected to the IDRAC port of the server. The pc was made part of the same subnet as that of server and interface was fine. The idrac mac address was statically added to the laptop arp table to see if there would be any difference but none...
... View more
Hi All, A dell 240 server is connected on two different switch ports with proper vlan configurations on the switch end. The server vendor claims to have put a static ip address without gateway on both these ports and the ip's do match the subnet range of the vlans under which the ports are access ports. The interface is showing physically up on the Cisco 3750 switch, but ARP is not being learnt. Another server with the same port level configuration on the same Cisco 3750 switch is working fine. As a test i disconnected the server from the switch totally and connected a laptop directly to the ports on the server and configured the ip address of the laptop to be in the range of the static ip address of the server and default gateway was set to server ports static ip address. Tried a direct ping to the static ip but get request timed out. Had initiated a Wireshark capture during the ping and observed that the server is not responding to ARP request itself. I am not able to understand why the server is behaving so. Unfortunately, i do not have access to the server to confirm if the static ip address is indeed set ? But the vendor tells me the default gateway is not set. The working server ports too do not have the default gateway not set on them but it works fine. The switch-ports that connect to the server are trunk ports. Unable to understand the reason for such behavior. Any suggestions please..
... View more
Hi Seb, Thanks for the reply. I missed specifying a point in the question i posted, its as follows. There is IBGP between the the two sites. Please see attached diagram. From the diagram you can see that idea is to ensure that RHS and LHS branches take the preferred path as their respective exit points with the possibility of having a backup path from either sites through the "site A and Site B interconnect". In the IBGP the site A advertises to site B the path to egress to the cloud, Hence traffic for all sites LHS and RHS just go to Site A and egress from there. Will the below approach work ? Also do i need to advertise the same route over IBGP from site A to B and Site B to A (for failover) ? > Reduce the local preference on the IBGP route to say 50 > Keep the local preference for the same route to respective egress points on site A and Site B to default (100) This will ensure that branch sites on B egress through site B while the branch sites on A egress through site A. In case of a link failure BGP would detect the loss of route and the next best route would be the one with local preference set to 50 and hence would exit through either site A or Site B. I intend to put the below config on Site B : configure terminal ip prefix-list LOW_LP_PREFIXES99 seq 10 permit 10.99.0.0/16 ip prefix-list LOW_LP_PREFIXES102 seq 20 permit 10.102.0.0/19 route-map LOCALPREF99 permit 10 match ip address prefix-list LOW_LP_PREFIXES99 set local-preference 50 route-map LOCALPREF102 permit 20 match ip address prefix-list LOW_LP_PREFIXES102 set local-preference 50 exit route-map LOCALPREF permit 30 exit router bgp 65111 neighbor 10.200.1.1 route-map LOCALPREF99 in neighbor 10.200.1.1 route-map LOCALPREF102 in exit Thanks for your help !
... View more
Hi All, I intend to direct certain traffic to go through a specific path. The destination has two paths therefore i want to ensure that primary path is taken always, but there should be the possibility to take the backup path (failover). By increasing local preference i can set primary path but how to configure failover mechanism ? The links are "Metro Ethernet". PATH 1 neighbor <BGP neighbor1> route-map LOCAL-PREF-150 in ip prefix-list <test1> seq 5 permit <route being received> route-map LOCAL-PREF-150 permit 10 match ip address prefix-list <test> set local-preference 150 PATH 2 neighbor <BGP neighbor2> route-map LOCAL-PREF-120 in ip prefix-list <test2> seq 6 permit <route being received> route-map LOCAL-PREF-150 permit 11 match ip address prefix-list <test2> set local-preference 120 Thanks for guidance
... View more