Hi Oleg, Can you perhaps send both the switches' interface configs...   We cannot troubleshoot with only half the info...   Ciao JC ... View more

Hi Sally, As far as I know the stackwise virtual option does not work between already stacked switches. I might be wrong...   So that would leave you with only the one option using two stacks of 3 each switches, configured as collapsed core/distribution. If your requirement is to have VLANs span across different access (edge) switches then you will need to have the HSRP with STP tweaking option. What I mean by tweaking is that you will need to pair the active HSRP side with the STP root Bridge for optimization of traffic flow. If the requirement is to have unique VLANs per access(edge) switch then you may have Layer 3 links between access and core (thus no need for STP and HSRP), but for me it sounds like this is not the option.   I hope this helps. Good luck and enjoy the experience Ciao JC ... View more

Hi Sally, HSRP and STP tweaking will work. My question is how much redundancy do you want. If you think about it having 3850's in a stack is already creating a redundant system if you populate your connections correctly. If you need the 'core' to be distributed across different physical cabinets then you need 2 stacks with HSRP or you could opt to use the stackwise virtual option which is also available https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/16-6/configuration_guide/b_166_stck_mgr_ha_3850/b_166_stck_mgr_ha_3850_chapter_010.pdf My opinion is to use what is simple and what you and your techies understand... Hope this helps you decide... Ciao JC ... View more

Hi Martin, Yes you are correct that you must use a route-map whenever redistributing on NX-OS. If I remember this is the same on ASR9K's as well, but don't assume this... ;-)   The reason might be that you as the network admin 1.)know exactly what you are redistributing and 2.) to have good control over what you are redistributing.   The easiest in your case is to allow all in that route-map...   Hope this helps and enjoy! Ciao JC ... View more

Hi All, I get the below error when trying to view the content on dcloud... "The content you are trying to access has either been removed or you do not have the permission required to view it." I tried different datacentres... Please advise. Ciao JC ... View more

Hi S, For me it looks like you have your interface names misconfigured... From what I can gather from the config you need to change the nat statement to: nat ( inside, Internet ) source static  OwnCloud interface service HTTP_Service HTTP_Service Change in red From your config I cannot gather it the 'inside' is the correct interface name for the more secure interface...But it looks like the 'OUTSIDE' interface in your case is named 'Internet' Good luck Ciao JC ... View more

Hi S, There are many config guides and examples on the Internet and google will be your best friend here. http://www.cisco.com/c/en/us/support/security/asa-5500-series-next-generation-firewalls/products-installation-and-configuration-guides-list.html So to answer your question: Challenge: You want users from inside and internet to access a server on the inside: Lets do the inside 1st. Because both the server and users are both on the inside you need not do anything. For the outside (Internet) to access the internal server you would need to allocate a public routable IP address or make use of port forwarding using the Internet interface. Port forwarding config would be something like: =====begin config snippet===== object network www_server  host 10.110.0.13  nat (DATA-LAN,Internet) static interface service tcp 80 80 access-list outside_access_in extended permit tcp any object www_server eq 80 access-group outside_access_in in interface Internet =====end config snippet===== If you send public IP I can change to suite that as well... Good luck JC ... View more

Hi C, If you have issues with OSPF I can help, but please send some show outputs or debugs. If you have issues with the packet tracer application I cannot help and quite frankly am not willing to install 3rd party SW for this. Good luck Ciao JC ... View more

Hi Philip, Just a couple of thoughts that might help...and please comment if you disagree... You are quite right that a per-user acl and dacl are set by radius. A per-user acl can be a type of dacl, because you can 'download' a specific acl per user or per group. So if you think of that there is really not big difference. Also, a per-user acl dont have to be downloaded, it can be a pre-configured acl on the (NAS) device and the radius reply can just include the name of the acl to apply. Maybe if you give an implementation example someone can maybe help more in depth. Ciao JC ... View more