Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About agrayson
Stats
Member since
12-31-2008
35
Posts
0
Helpful
0
Solutions
11-09-2012
10:53 AM
I have a working DMVPN solution. I am trying to stand up a secondary DMVPN hub at our disaster recovery site. We are trying to deply to a Dual HUB SIngle DMVPN solution. The HUB2 DMVPN router has an INSIDE trusted interface and has an OUTSIDE UNTRUSTED interface. The inside is 10.248.11.X...the Untrust/public is 192.168.93.11 which is connected to our DMZ 3 on the ASA 5520.....then I am trying to NAT the 192.168.93.11 to an outside public IP 199.248.30.X....just not working...have had 2 tickets open with Cisco this week and they still are unable to resolve. I am sure it is the ASA5520 is not configured correctly but not sure what I am missing. Thanks for any help...links...done it before...comments I can provide more details
... View more
Labels:
Created by
agrayson
in Wireless and Mobility
in Wireless and Mobility
11-23-2011
12:13 PM
11-23-2011
12:13 PM
We are trying to allow LWAP to access INSIDE LAN via access switches then using Option43 point them to 5508 which are only connected to DMZ switch. The LAP cannot find WLC server still... not sure our design will work. I cannot find good documentation for doing this with a 5508 Our intent is that all wireless can only reside in the DMZ but the AP will be sitting on INSIDE LAN I have attached PDF with 2 network designs..both are the same but the second is better detailed here is the error I ma getting on the AP Translating "CISCO-CAPWAP-CONTROLLER.langleyfcu.org"...domain server (10.248.55.25) *Mar 1 05:21:35.716: %CAPWAP-5-DHCP_OPTION_43: Controller address 49.57.50.46 obtained through DHCP *Mar 1 05:21:35.716: %CAPWAP-5-DHCP_OPTION_43: Controller address 49.54.56.46 obtained through DHCP *Mar 1 05:21:35.716: %CAPWAP-5-DHCP_OPTION_43: Controller address 53.49.46.50 obtained through DHCP *Mar 1 05:22:15.717: %CAPWAP-3-DHCP_RENEW: Could not discover WLC using DHCP IP. Renewing DHCP IP. Not in Bound state. *Mar 1 05:22:25.875: %DHCP-6-ADDRESS_ASSIGN: Interface GigabitEthernet0 assigned DHCP address 10.248.23.29, mask 255.255.255.0, hostname AP70ca.9b99.4859 Translating "CISCO-CAPWAP-CONTROLLER.langleyfcu.org"...domain server (10.248.55.25) *Mar 1 05:22:32.219: %CAPWAP-5-DHCP_OPTION_43: Controller address 49.57.50.46 obtained through DHCP *Mar 1 05:22:32.219: %CAPWAP-5-DHCP_OPTION_43: Controller address 49.54.56.46 obtained through DHCP *Mar 1 05:22:32.219: %CAPWAP-5-DHCP_OPTION_43: Controller address 53.49.46.50 obtained through DHCP *Mar 1 05:23:12.221: %CAPWAP-3-DHCP_RENEW: Could not discover WLC using DHCP IP. Renewing DHCP IP. Not in Bound state. *Mar 1 05:23:22.756: %DHCP-6-ADDRESS_ASSIGN: Interface GigabitEthernet0 assigned DHCP address 10.248.23.29, mask 255.255.255.0, hostname AP70ca.9b99.4859 Translating "CISCO-CAPWAP-CONTROLLER.langleyfcu.org"...domain server (10.248.55.25) Thanks
... View more
Labels:
03-24-2010
08:16 AM
Thanks...I am not configuring Netflow on the 3560...I have it running on my Cisco 2600s and 2800s...WAN connection. So when I use Orion Netflow and look at the upstream router with Netflow configured it shows that the IP phones are using a high percentage of BW. I do not see the source IP of the PC connected to the phone but I think that since the phone is a hub all traffic from the PC hits the phone (next hop) and thats what we see is a combination of both vocie and data traffic. So I trying to see if there is a way to split this out so you see traffic from PC with the PC IP as the source and traffic from the voice as the phone IP. But are you saying that since the 3560 series does not support Netflow we can not see those distint flows on the upstrean WAN router that the switch connects to? Thanks again for the quick response
... View more
03-24-2010
07:44 AM
We use Cisco 3560 switches and we use AVAYA 9630 IP Phones. The users PC is connectd to the IP Phone. The switch port is configured with both the LAN VLAN and the VOICE VLAN switchport access vlan 26 switchport mode access switchport voice vlan 206 When capturing traffic with Netflow I see a source traffic from a phone IP and it is using a high percentage of band width. We dont think it is the phone but the PC and we are trying to figure out how to better break that out so we see the true phone IP use and the true PC use that hangs off the phone. Any suggestions Thanks
... View more
Labels:
03-23-2010
05:22 AM
Giuseppe Yes you are correct. But I am not use GRE tunnels or the DMVPN solution. I do have a project to move to a DMVPN solution but we need to do a hardware refresh first. So what are my options since I am not using GRE. Thanks
... View more
03-22-2010
10:22 AM
Jon The primary circuit is the WAN connection. The VPN backup uses a HFC cable modem to access internet to spin up the VPN tunnels when WAN circuit is down. Since we have a limited BW and a 10MB internet pipe the thought was not to use the 10 MB internet pipe and also we can still use websense to monitor internet. Does that make since ??...currently the (HFC) Hybrib Fiber Coaxual is 2 MB down and 384 K up ....not real sure if this will with BW because all that traffic will be in the failover pipe...instead of NONAT split tunneled. However it will give us better visiblity and control on the internet traffic. Just looking for thoughts and maybe best practice. Does following look correct??? router eigrp 1 redistribute static route-map static2eigrp route-map static2eigrp permit 10 match ip address 10 access-list 10 permit 0.0.0.0
... View more
03-22-2010
08:42 AM
I want to see if there is a better ...best practice way to make the quad 0 internet availiable if the site fails over to VPN when main circuit is down. As it is now when a sitre fails over to VPN it uses that connection for internet traffic but I want it to use the our normal internet connection. This is the config I found but this does not seem to work. I am doing S2S VPN with routers and it works fine...just I would like to have the internet traffic go through our primary internet connection and not out the VPN failover connection. router eigrp 1 redistribute static route-map static2eigrp route-map static2eigrp permit 10 match ip address 10 access-list 10 permit 0.0.0.0
... View more
Labels:
Created by
agrayson
in Other Security Subjects
in Other Security Subjects
07-27-2009
11:32 AM
07-27-2009
11:32 AM
Thanks thats great ...good ideal I just dont want to remove something and break it...
... View more
07-27-2009
07:03 AM
I have a simple question but I am having a hard time getting an answer. WHen you do show access-list command on the ASA 5510 there is a hit count ....i know how to clear that but I want to knowis there a default timer that will clear the hit count ? Or does the hit count remain till I clear the count? I am trying to clean up some ACLs and for future troubleshooting I would like to know that. I dont want to remove an ACL entry with 0 hitcount and then it is needed.
... View more
Labels:
06-17-2009
06:59 AM
thanks for the quick replay...I currently use sub interfaces and understand trunking and how to configure it. I normally dont put an IP address on the interface ...only the sub-interfaces. Secondary IPs we have considered and will work well with EIGRP as I deploy now. I think I may have caused an outage with adding sub interfaces to an interface that already had a layer 3 IP but I am not sure because I never lost connectivity with the router but could not ping other devices at site. I removed the config change but still no joy...I searched Cisco site but have not found a clear answer. I did replace the router last night due to the other router fan dying and then it went into ROMMON etc...so it may have all just been a coincidence but I am looking for best practice and or does that cause packet loss
... View more
06-17-2009
06:36 AM
Can a INTERFACE like fa0/1 have a layer 3 IP address and then I create a subinterfaces say fa0/1.1 and put an IP address on them as well with DOT1Q....should this be done I have read mixed comments...not best practice I know but I am trying to do configs ahead of time to migrate IP schema...we are moving from 199.x.x.x to 10.x.x.x so the fa0/0 is 199.x.x.x and the fa0/1.1 is 10x.x.x.
... View more
Labels:
05-11-2009
10:34 AM
Thanks...the scope was on a different server...corrected the helper and works..I was told 1 thing but was on a different server. It works just like it is supposed to. Thanks
... View more
05-07-2009
10:59 AM
correction I am trying to have a conference room that will have ports that are placed in a CCA server vlan 94 untrust and if they pass posture accessment then they are placed in TRUSTED vlan93
... View more
05-07-2009
10:57 AM
I am new to the NAC solution but I have a VPN SSO Layer 3 VG INBAND MODE configuration that works with the VPN solution and now I want to expand my current config to do more. I am trying to have a conference room that will have ports that are placed in a CCA server vlan 94 untrust and if they pass posture accessment then they are placed in untrust vlan93. This works for the most part except for DNS...ie I have to put in the yahoo IP...also I am unable to pull a DHCP address...if I assign a vlan 93 IP I get the CAA to pop up and I can log into the local DB...but if I set to DHCP it will not pull an address. see attached sample
... View more
Labels:
Created by
agrayson
in VPN and AnyConnect
in VPN and AnyConnect
05-05-2009
10:08 AM
05-05-2009
10:08 AM
I currently have ASA 5510 VPN that is configured to work with NAC 4.5 inline mode with Virtual GW and CCA using VPN Single Sign On with Active Directory via a MS IAS Radius server. I am trying to use the AUTH Servers mapping rules feature on the NAC manager. The vendor will have an AD account and be in the VPNUsers AD group which matches the attribute on the MS IAS Radius server but I am trying to assign different NAC roles depending on the user in that group. I read the docs but I am no MS IAS expert and I have tried a couple attributes but not working. Getting the mapping rules working would really fix all the issues because I can assign more restrictive roles to vendors and create roles for IT...Finance ETC but maintain 1 RADIUS server...with 1 AD group....I can find example using LDAP mapping but nothing of real help for Radius mapping
... View more
Labels:
11-09-2012
I have a working DMVPN solution. I am trying to stand up a secondary
DMVPN hub at our disaster recov...
11-23-2011
We are trying to allow LWAP to access INSIDE LAN via access switches
then using Option43 point them ...
03-24-2010
Thanks...I am not configuring Netflow on the 3560...I have it running on
my Cisco 2600s and 2800s......
03-24-2010
We use Cisco 3560 switches and we use AVAYA 9630 IP Phones. The users PC
is connectd to the IP Phone...
03-22-2010
I want to see if there is a better ...best practice way to make the quad
0 internet availiable if th...
07-27-2009
I have a simple question but I am having a hard time getting an answer.
WHen you do show access-list...
06-17-2009
thanks for the quick replay...I currently use sub interfaces and
understand trunking and how to conf...
06-17-2009
Can a INTERFACE like fa0/1 have a layer 3 IP address and then I create a
subinterfaces say fa0/1.1 a...
05-11-2009
Thanks...the scope was on a different server...corrected the helper and
works..I was told 1 thing bu...
05-07-2009
correctionI am trying to have a conference room that will have ports
that are placed in a CCA server...
05-07-2009
I am new to the NAC solution but I have a VPN SSO Layer 3 VG INBAND MODE
configuration that works wi...
Public Statistics
| Date Registered | 12-31-2008 10:09 AM |
| Date Last Visited | 08-18-2017 03:53 AM |
| Total Messages Posted | 35 |
