This should work out for you: default interface ser0/2/0 default interface ser0/3/0 default interface ser0/1/0 no int mul 1 ### If using ser 0/1/0 as surviving T1 int ser 0/1/0 description internet via PROVIDER ip address OUR.EXTERNAL.IP.ADDRESS 255.255.255.252 no cdp enable no ip address no ip redirects no ip proxy-arp encapsulation ppp tx-ring-limit 26 tx-queue-limit 26 no fair-queue exit ... View more

That show command looks like it may be unsupported: Unsupported Privileged EXEC Commands show interfaces [ interface-id | vlan vlan-id ] [ crb | fair-queue | irb | mac-accounting | precedence | irb | random-detect | rate-limit | shape ] http://www.cisco.com/en/US/docs/switches/lan/catalyst3560/software/release/12.2_25_sea/configuration/guide/swuncli.html ... View more

When the problem is occurring try a 'show policy-map interface g0/2'.  This should give you and indication if the traffic in question is being matched by the WINUP class. Chris ... View more

In this example it would not police per-flow.  It would police all traffic matching the class WINUP to 750Kbps.  You may want to investigate micro-flow policing on the downstream switch. This link has some good micro-flow info: http://www.cisco.com/en/US/products/hw/switches/ps700/products_tech_note09186a00801c8c4b.shtml Chris ... View more

A good first step is to try NAT.  The following may work for you: int e0 ip nat outside exit int fa0/0 ip nat inside exit access-list 100 remark *** NAT Selection *** access-list 100 permit ip 10.10.1.0 0.0.0.255 any ip nat inside source list 110 interface e0 overload This link is a good read: http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080094e77.shtml Chris ... View more

Not sure if this is supported on your code/feature set/platform; but it's worth a try: ################## access-list (standard-ibm) To establish a MAC address access list, use the access-list command in global configuration mode. To remove access list, use the no form of this command. access-list access-list-number { permit | deny} address mask no access-list access-list-number Syntax Description access-list-number Integer from 700 to 799 that you select for the list. permit Permits the frame. deny Denies the frame. address mask 48-bit MAC addresses written as a dotted triple of four-digit hexadecimal numbers. The ones bits in the mask argument are the bits to be ignored in address. Defaults No MAC address access lists are established. Command Modes Global configuration Command History Release Modification 10.0 This command was introduced. 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA. 12.2SX This command is supported in the Cisco IOS Release 12.2SX train. Support  in a specific 12.2SX release of this train depends on your feature set,  platform, and platform hardware. Usage Guidelines Configuring bridging access lists of type 700 may cause a momentary interruption of traffic flow. Examples The following example assumes that you want to disallow the bridging of  Ethernet packets of all Sun workstations on Ethernet interface 1.  Software assumes that all such hosts have Ethernet addresses with the  vendor code 0800.2000.0000. The first line of the access list denies  access to all Sun workstations, and the second line permits everything  else. You then assign the access list to the input side of Ethernet  interface 1. access-list 700 deny 0800.2000.0000 0000.00FF.FFFF access-list 700 permit 0000.0000.0000 FFFF.FFFF.FFFF ! interface ethernet 1 bridge-group 1 input-address-list 700 Related Commands Command Description access-list (type-code-ibm) Builds type-code access lists. ... View more

Mahesh, It's more difficult than I anticipated to find a reference for the 'dot' preceding a message timestamp. You may find the following: "Cisco IOS uses a special convention for time prefixes to indicate the accuracy of the time stamp. If dot character appears before the date, it means that the local time was synchronized at some point via NTP, but currently no NTP servers are available. The asterisk character in front of the date means that the local time is not authoritative, i.e. NTP servers are not setup." At this link: http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/managed_services/ServErrMess.html Chris ... View more

The 'dot' in front of the message timestamp indicates the router/switch clock is out of sync.  Are you using an NTP server?  If so the router hasn't yet synced up with the NTP server.  A 'show ntp associations' at the time you are getting these messages will reveal this. Chris ... View more

I believe you'd be better served with a prefix list.  Consider the following. If you want any 192.x.x.x network with a subnet between 8 and 16 bits try this: ip prefix-list tango permit 192.0.0.0/8 le 16 The command reference for 'ip prefix-list' can be found here: http://www.cisco.com/en/US/docs/ios/iproute_bgp/command/reference/irg_bgp2.html#wp1094224 Chris ... View more

Worthless seems rather strong.  I've worked with clever network engineers that have leveraged these ports well.  I doesn't take a unique routing table (VRF).  It does take a rock solid foundation in networking. Chris ... View more

You bring up a really good point.  Most networking professionals understand the importance of 'out of band' management in regard to an rs-232 connection that provides the ultimate in knowing what the heck is going on during a failure situation.  If they don't they are only one disaster away from an education. Several networking devices have an Ethernet management port.  Certainly it's not the same as our trusty console port.  Not much has been written on how to properly utilize Ethernet ports for management.  I'm sure a lot of us have our own ideas but I haven't seen an official document from Cisco.  What I usually see is 'this port should be used for management and not for forwarding network traffic.'  I Haven't seen an architecture document that depicts the utopian management network. Lot's of good design info here: http://www.cisco.com/en/US/netsol/ns742/networking_solutions_program_category_home.html Perhaps a 'netowrk management' section is in order. Chris ... View more

You could use an aggregate policer on the 3750.  Each physical port that participates in the VLAN could be a participant of the aggregate policer; therefore the total bandwidth of all ports would never exceed the configured rate. http://www.cisco.com/en/US/docs/switches/lan/catalyst3750/software/release/12.2_55_se/configuration/guide/swqos.html#wp1048656 An easier approach may be to install a rate-limit on the ASA that matches the contractor netblock. http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/qos.html#wp1065257 Chris ... View more

Sorry James, I stand corrected!  You are correct, it's an extended ACL. Chris ... View more

Don't use an extended ACL.  The split-tunnel feature utilizes a standard ACL. Chris ... View more