Join two remote sites, use_nl or use_hash
We are using Oracle 10g R2 on Linux platform.
Suppose we have three remote sites A, B and C. I want to join two tables on B and C by executing a query on Site A. I cannot give driving_site hint because I do not have privileges for that.
Can you please answer the following question?
If I use nested loop join, both tables on site B and C shall be copied to the local site A and join shall be performed OR only one table, called the deriving table shall be copied on site A and second table shall be probed remotely?
In Hash Join, Oracle shall copy both tables B and C on site A and then perform the join?
| Id | Operation | Name | Rows | Bytes | Cost (%CPU)| Time | Inst |IN-OUT|
| 0 | SELECT STATEMENT | | 13084 | 907K| 11M (3)| 37:04:41 | | |
| 1 | NESTED LOOPS OUTER| | 13084 | 907K| 11M (3)| 37:04:41 | | |
| 2 | REMOTE | VISA_CIL01_GDA_INTEREST_PERIOD | 13084 | 344K| 15 (7)| 00:00:01 | CIL_G~ |
| 3 | REMOTE | VGUA_CIL01_ACCOUNT_ID | 1 | 44 | 850 (3)| 00:00:11 | CIL_G~ | R->S |
No; it means that when you are trying to work out whether or not a nested loop join .......
Can you please tell me scenario where I should use NL instead of Hash join
This means that the point at which you decide to switch from NL to Hash join will typically be for a smaller number of cycles round the loop, i.e. for a smaller amount of data.
Sorry, I could not get this point. Does it mean that we should use hash join when we have tables to join?
Do you have a URL for the document you read that gave this impression
Actually this is Oracle 8i documentation from which i get this concept, perhaps not feasible in Oracle 10g now. Tuning Distributed Queries
For the nested loop, the rows and columns needed by the outer (first) table will be pulled to the local site in relatively small batches, and for each row in that rowsource the inner (second) table will be probed across the network.
Can you please give me reference from Oracle documentation about the the above description to help me better understand the idea?
Similar Messages
-
Problem encountered when join two remote tables in a materialized view
I'm using oracle 9.2.0.6
1> I have two tables:
CREATE TABLE TEST
A VARCHAR2(100 BYTE),
C DATE
CREATE TABLE TEST1
A VARCHAR2(100 BYTE),
B TIMESTAMP
2>. I defined a prebuild table:
CREATE TABLE MV_TEST1
ID1 ROWID,
A VARCHAR2(100 BYTE),
ID2 ROWID,
B TIMESTAMP(6),
C DATE
3> I created mview logs:
CREATE MATERIALIZED VIEW LOG ON PSI_TEST.TEST
WITH ROWID
INCLUDING NEW VALUES;
CREATE MATERIALIZED VIEW LOG ON PSI_TEST.TEST1
WITH ROWID
INCLUDING NEW VALUES;
4> when I create mview:
CREATE MATERIALIZED VIEW PSI_TEST.MV_TEST1
ON PREBUILT TABLE WITH REDUCED PRECISION
REFRESH FAST ON DEMAND
WITH PRIMARY KEY
AS
select
test.rowid id1,
test.a,
test1.rowid id2,
test1.b,
cast(null as date) c
from test , test1
where test.a = test1.a(+);
It is created successfully.
5> problem:
when I use remote tables to do the same thing, say test and test1 are in another instance and are connected by a dbLink, I couldn't create the mview successfully:
CREATE MATERIALIZED VIEW PSI_TEST.MV_TEST1
ON PREBUILT TABLE WITH REDUCED PRECISION
REFRESH FAST ON DEMAND
WITH PRIMARY KEY
AS
select
a.rowid id1,
a.a,
b.rowid id2,
b.b,
cast(null as date) c
from test@dbl a, test1@dbl b
where a.a = b.a(+);
when run above statement, I got:
ORA-12015: cannot create a fast refresh materialized view from a complex query
Any ideas? Or joining two table through a dblink for a mview is not allowed at all?
Thanks in advance.No one has a clue?
Message was edited by:
lzhwxy -
Hi, i have two dynamic websites each connecting to two
separate databases via separate connections. I have tried merging
the two sites into one, but i get a problem because the database
connection for one of the sites dont work after i join them. Can
anyone please tell me the best way to join two dynamic sites
together, so that both their databases work.
thank youthe best way to do it is to create a DSN connection but you
have to make
sure that they are on the same server
if both the websites are on the same server that it can be
easily done using
DSN connection -
I have a host and two remote sites. The remotes have site-to-site VPNs to the host. The two remotes can communicate just fine to the host, however the remotes cannot communicate with each other. I do not want to establish a site-to-site between the two remotes. How do I configure the host site to enable the two remotes to communicate?
At the host site I have a PIX 515e and the remotes have 1760s.
Thanksyou cannot. a pix will not do this. configure a site to site between the 1760s, or replace the pix with a IOS router or a 3000 series concentrator.
-
VPN Clients cannot access remote site
Hey there,
I am pretty new in configuring Cisco devices and now I need some help.
I have 2 site here:
site A
Cisco 891
external IP: 195.xxx.yyy.zzz
VPN Gateway for Remote users
local IP: VLAN10 10.133.10.0 /23
site B
Cisco 891
external IP: 62.xxx.yyy.zzz
local IP VLAN10 10.133.34.0 /23
Those two sites are linked together with a Site-to-Site VPN. Accessing files or ressources from one site to the other is working fine while connected to the local LAN.
I configured VPN connection with Radius auth. VPN clients can connect to Site A, get an IP adress from VPN Pool (172.16.100.2-100) and can access files and servers on site A. But for some reason they cannot access ressources on site B. I already added the site B network to the ACL and when connecting with VPN it shows secured routes to 10.133.10.0 and 10.133.34.0 in the statistics. Same thing for other VPN Tunnels to ERP system.
What is missing here to make it possible to reach remote sites when connected through VPN? I had a look at the logs but could not find anything important.
Here is the config of site A
Building configuration...
Current configuration : 24257 bytes
version 15.2
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
hostname Englerstrasse
boot-start-marker
boot config usbflash0:CVO-BOOT.CFG
boot-end-marker
aaa new-model
aaa group server radius Radius-AD
server 10.133.10.5 auth-port 1812 acct-port 1813
aaa authentication login default local
aaa authentication login ciscocp_vpn_xauth_ml_2 group Radius-AD local
aaa authorization exec default local
aaa authorization network ciscocp_vpn_group_ml_2 local
aaa session-id common
clock timezone Berlin 1 0
clock summer-time Berlin date Mar 30 2003 2:00 Oct 26 2003 3:00
crypto pki trustpoint TP-self-signed-27361994
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-27361994
revocation-check none
rsakeypair TP-self-signed-27361994
crypto pki trustpoint test_trustpoint_config_created_for_sdm
subject-name [email protected]
revocation-check crl
crypto pki certificate chain TP-self-signed-27361994
certificate self-signed 01
30820227 30820190 A0030201 02020101 300D0609 2A864886 F70D0101 05050030
2F312D30 2B060355 04031324 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 32373336 31393934 301E170D 31323038 32373038 30343238
5A170D32 30303130 31303030 3030305A 302F312D 302B0603 55040313 24494F53
2D53656C 662D5369 676E6564 2D436572 74696669 63617465 2D323733 36313939
3430819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281 8100B709
64CE1874 BF812A9F 0B761522 892373B9 10F0BB52 6263DCDB F9877AA3 7BD34E53
BCFDA45C 2A991777 4DDC7E6B 1FCEE36C B6E35679 C4A18771 9C0F871F 38310234
2D89A4FF 37B616D8 362B3103 A8A319F2 10A72DC7 490A04AC 7955DF68 32EF9615
9E1A3B31 2A1AB243 B3ED3E35 F4AAD029 CDB1F941 5E794300 5C5EF8AE 5C890203
010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603 551D2304
18301680 14D0F5E7 D3A9311D 1675AA8F 38F064FC 4D04465E F5301D06 03551D0E
04160414 D0F5E7D3 A9311D16 75AA8F38 F064FC4D 04465EF5 300D0609 2A864886
F70D0101 05050003 818100AB 2CD4363A E5ADBFB0 943A38CB AC820801 117B52CC
20216093 79D1F777 2B3C0062 4301CF73 094B9CA5 805F585E 04CF3301 9B839DEB
14A334A2 F5A5316F C65EEF21 0B0DF3B5 F4322440 F28B984B E769876D 6EF94895
C3D5048A A4E2A180 12DF6652 176942F8 58187D7B D37B1F1A 4DDD7AE9 5189F9AF
AF3EF676 26AD3F31 D368F5
quit
crypto pki certificate chain test_trustpoint_config_created_for_sdm
no ip source-route
ip auth-proxy max-login-attempts 5
ip admission max-login-attempts 5
no ip bootp server
no ip domain lookup
ip domain name yourdomain.com
ip inspect log drop-pkt
ip inspect name CCP_MEDIUM appfw CCP_MEDIUM
ip inspect name CCP_MEDIUM ftp
ip inspect name CCP_MEDIUM h323
ip inspect name CCP_MEDIUM sip
ip inspect name CCP_MEDIUM https
ip inspect name CCP_MEDIUM icmp
ip inspect name CCP_MEDIUM netshow
ip inspect name CCP_MEDIUM rcmd
ip inspect name CCP_MEDIUM realaudio
ip inspect name CCP_MEDIUM rtsp
ip inspect name CCP_MEDIUM sqlnet
ip inspect name CCP_MEDIUM streamworks
ip inspect name CCP_MEDIUM tftp
ip inspect name CCP_MEDIUM udp
ip inspect name CCP_MEDIUM vdolive
ip inspect name CCP_MEDIUM imap reset
ip inspect name CCP_MEDIUM smtp
ip cef
no ipv6 cef
appfw policy-name CCP_MEDIUM
application im aol
service default action allow alarm
service text-chat action allow alarm
server permit name login.oscar.aol.com
server permit name toc.oscar.aol.com
server permit name oam-d09a.blue.aol.com
audit-trail on
application im msn
service default action allow alarm
service text-chat action allow alarm
server permit name messenger.hotmail.com
server permit name gateway.messenger.hotmail.com
server permit name webmessenger.msn.com
audit-trail on
application http
strict-http action allow alarm
port-misuse im action reset alarm
port-misuse p2p action reset alarm
port-misuse tunneling action allow alarm
application im yahoo
service default action allow alarm
service text-chat action allow alarm
server permit name scs.msg.yahoo.com
server permit name scsa.msg.yahoo.com
server permit name scsb.msg.yahoo.com
server permit name scsc.msg.yahoo.com
server permit name scsd.msg.yahoo.com
server permit name cs16.msg.dcn.yahoo.com
server permit name cs19.msg.dcn.yahoo.com
server permit name cs42.msg.dcn.yahoo.com
server permit name cs53.msg.dcn.yahoo.com
server permit name cs54.msg.dcn.yahoo.com
server permit name ads1.vip.scd.yahoo.com
server permit name radio1.launch.vip.dal.yahoo.com
server permit name in1.msg.vip.re2.yahoo.com
server permit name data1.my.vip.sc5.yahoo.com
server permit name address1.pim.vip.mud.yahoo.com
server permit name edit.messenger.yahoo.com
server permit name messenger.yahoo.com
server permit name http.pager.yahoo.com
server permit name privacy.yahoo.com
server permit name csa.yahoo.com
server permit name csb.yahoo.com
server permit name csc.yahoo.com
audit-trail on
parameter-map type inspect global
log dropped-packets enable
multilink bundle-name authenticated
redundancy
ip tcp synwait-time 10
class-map match-any CCP-Transactional-1
match dscp af21
match dscp af22
match dscp af23
class-map match-any CCP-Voice-1
match dscp ef
class-map match-any sdm_p2p_kazaa
match protocol fasttrack
match protocol kazaa2
class-map match-any CCP-Routing-1
match dscp cs6
class-map match-any sdm_p2p_edonkey
match protocol edonkey
class-map match-any CCP-Signaling-1
match dscp cs3
match dscp af31
class-map match-any sdm_p2p_gnutella
match protocol gnutella
class-map match-any CCP-Management-1
match dscp cs2
class-map match-any sdm_p2p_bittorrent
match protocol bittorrent
policy-map sdm-qos-test-123
class class-default
policy-map sdmappfwp2p_CCP_MEDIUM
class sdm_p2p_edonkey
class sdm_p2p_gnutella
class sdm_p2p_kazaa
class sdm_p2p_bittorrent
policy-map CCP-QoS-Policy-1
class sdm_p2p_edonkey
class sdm_p2p_gnutella
class sdm_p2p_kazaa
class sdm_p2p_bittorrent
class CCP-Voice-1
priority percent 33
class CCP-Signaling-1
bandwidth percent 5
class CCP-Routing-1
bandwidth percent 5
class CCP-Management-1
bandwidth percent 5
class CCP-Transactional-1
bandwidth percent 5
class class-default
fair-queue
random-detect
crypto ctcp port 10000
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key REMOVED address 62.20.xxx.yyy
crypto isakmp key REMOVED address 195.243.xxx.yyy
crypto isakmp key REMOVED address 195.243.xxx.yyy
crypto isakmp key REMOVED address 83.140.xxx.yyy
crypto isakmp client configuration group VPN_local
key REMOVED
dns 10.133.10.5 10.133.10.7
wins 10.133.10.7
domain domain.de
pool SDM_POOL_2
acl 115
crypto isakmp profile ciscocp-ike-profile-1
match identity group VPN_local
client authentication list ciscocp_vpn_xauth_ml_2
isakmp authorization list ciscocp_vpn_group_ml_2
client configuration address respond
virtual-template 1
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-SHA1 esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-SHA2 esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-SHA3 esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-SHA4 esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-SHA11 esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-SHA5 esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-DES-SHA1 esp-des esp-sha-hmac
crypto ipsec profile CiscoCP_Profile1
set transform-set ESP-3DES-SHA11
set isakmp-profile ciscocp-ike-profile-1
crypto map SDM_CMAP_1 1 ipsec-isakmp
description Tunnel to62.20.xxx.xxx
set peer 62.20.xxx.xxx
set transform-set ESP-3DES-SHA
match address 105
crypto map SDM_CMAP_1 2 ipsec-isakmp
description Tunnel to195.243.xxx.xxx
set peer 195.243.xxx.xxx
set transform-set ESP-3DES-SHA4
match address 107
crypto map SDM_CMAP_1 3 ipsec-isakmp
description Tunnel to83.140.xxx.xxx
set peer 83.140.xxx.xxx
set transform-set ESP-DES-SHA1
match address 118
interface Loopback2
ip address 192.168.10.1 255.255.254.0
interface Null0
no ip unreachables
interface FastEthernet0
switchport mode trunk
no ip address
spanning-tree portfast
interface FastEthernet1
no ip address
spanning-tree portfast
interface FastEthernet2
no ip address
spanning-tree portfast
interface FastEthernet3
no ip address
spanning-tree portfast
interface FastEthernet4
description Internal LAN
switchport access vlan 10
switchport trunk native vlan 10
no ip address
spanning-tree portfast
interface FastEthernet5
no ip address
spanning-tree portfast
interface FastEthernet6
no ip address
spanning-tree portfast
interface FastEthernet7
no ip address
spanning-tree portfast
interface FastEthernet8
description $FW_OUTSIDE$$ETH-WAN$
ip address 62.153.xxx.xxx 255.255.255.248
ip access-group 113 in
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
ip inspect CCP_MEDIUM out
no ip virtual-reassembly in
ip verify unicast reverse-path
duplex auto
speed auto
crypto map SDM_CMAP_1
service-policy input sdmappfwp2p_CCP_MEDIUM
service-policy output CCP-QoS-Policy-1
interface Virtual-Template1 type tunnel
ip unnumbered FastEthernet8
tunnel mode ipsec ipv4
tunnel protection ipsec profile CiscoCP_Profile1
interface GigabitEthernet0
no ip address
shutdown
duplex auto
speed auto
interface Vlan1
no ip address
interface Vlan10
description $FW_INSIDE$
ip address 10.133.10.1 255.255.254.0
ip access-group 112 in
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
ip nat inside
ip virtual-reassembly in
interface Async1
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
encapsulation slip
ip local pool SDM_POOL_1 192.168.10.101 192.168.10.200
ip local pool VPN_Pool 192.168.20.2 192.168.20.100
ip local pool SDM_POOL_2 172.16.100.2 172.16.100.100
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip forward-protocol nd
ip nat inside source route-map SDM_RMAP_1 interface FastEthernet8 overload
ip route 0.0.0.0 0.0.0.0 62.153.xxx.xxx
ip access-list extended VPN1
remark VPN_Haberstrasse
remark CCP_ACL Category=4
permit ip 10.133.10.0 0.0.1.255 10.133.34.0 0.0.1.255
ip radius source-interface Vlan10
access-list 1 remark INSIDE_IF=Vlan1
access-list 1 remark CCP_ACL Category=2
access-list 1 permit 10.10.10.0 0.0.0.7
access-list 23 remark CCP_ACL Category=17
access-list 23 permit 195.243.xxx.xxx
access-list 23 permit 10.133.10.0 0.0.1.255
access-list 23 permit 10.10.10.0 0.0.0.7
access-list 100 remark CCP_ACL Category=4
access-list 100 permit ip 10.133.10.0 0.0.1.255 any
access-list 101 remark CCP_ACL Category=16
access-list 101 permit udp any eq bootps any eq bootpc
access-list 101 deny ip 10.10.10.0 0.0.0.255 any
access-list 101 permit icmp any any echo-reply
access-list 101 permit icmp any any time-exceeded
access-list 101 permit icmp any any unreachable
access-list 101 deny ip 10.0.0.0 0.255.255.255 any
access-list 101 deny ip 172.16.0.0 0.15.255.255 any
access-list 101 deny ip 192.168.0.0 0.0.255.255 any
access-list 101 deny ip 127.0.0.0 0.255.255.255 any
access-list 101 deny ip host 255.255.255.255 any
access-list 101 deny ip any any
access-list 102 remark auto generated by CCP firewall configuration
access-list 102 remark CCP_ACL Category=1
access-list 102 deny ip 10.10.10.0 0.0.0.7 any
access-list 102 permit icmp any host 62.153.xxx.xxx echo-reply
access-list 102 permit icmp any host 62.153.xxx.xxx time-exceeded
access-list 102 permit icmp any host 62.153.xxx.xxx unreachable
access-list 102 deny ip 10.0.0.0 0.255.255.255 any
access-list 102 deny ip 172.16.0.0 0.15.255.255 any
access-list 102 deny ip 192.168.0.0 0.0.255.255 any
access-list 102 deny ip 127.0.0.0 0.255.255.255 any
access-list 102 deny ip host 255.255.255.255 any
access-list 102 deny ip host 0.0.0.0 any
access-list 102 deny ip any any log
access-list 103 remark auto generated by CCP firewall configuration
access-list 103 remark CCP_ACL Category=1
access-list 103 remark IPSec Rule
access-list 103 permit ip 10.133.34.0 0.0.1.255 10.133.10.0 0.0.1.255
access-list 103 remark IPSec Rule
access-list 103 permit ip 10.133.34.0 0.0.1.255 192.168.10.0 0.0.1.255
access-list 103 permit udp host 195.243.xxx.xxx host 62.153.xxx.xxx eq non500-isakmp
access-list 103 permit udp host 195.243.xxx.xxx host 62.153.xxx.xxx eq isakmp
access-list 103 permit esp host 195.243.xxx.xxx host 62.153.xxx.xxx
access-list 103 permit ahp host 195.243.xxx.xxx host 62.153.xxx.xxx
access-list 103 remark IPSec Rule
access-list 103 permit ip 10.133.20.0 0.0.0.255 10.133.10.0 0.0.1.255
access-list 103 remark IPSec Rule
access-list 103 permit ip 192.168.10.0 0.0.1.255 10.133.10.0 0.0.1.255
access-list 103 permit udp host 62.20.xxx.xxx host 62.153.xxx.xxx eq non500-isakmp
access-list 103 permit udp host 62.20.xxx.xxx host 62.153.xxx.xxx eq isakmp
access-list 103 permit esp host 62.20.xxx.xxx host 62.153.xxx.xxx
access-list 103 permit ahp host 62.20.xxx.xxx host 62.153.xxx.xxx
access-list 103 permit udp any host 62.153.xxx.xxx eq non500-isakmp
access-list 103 permit udp any host 62.153.xxx.xxx eq isakmp
access-list 103 permit esp any host 62.153.xxx.xxx
access-list 103 permit ahp any host 62.153.xxx.xxx
access-list 103 permit udp host 194.25.0.60 eq domain any
access-list 103 permit udp host 194.25.0.68 eq domain any
access-list 103 permit udp host 194.25.0.68 eq domain host 62.153.xxx.xxx
access-list 103 deny ip 10.10.10.0 0.0.0.7 any
access-list 103 permit icmp any host 62.153.xxx.xxx echo-reply
access-list 103 permit icmp any host 62.153.xxx.xxx time-exceeded
access-list 103 permit icmp any host 62.153.xxx.xxx unreachable
access-list 103 deny ip 10.0.0.0 0.255.255.255 any
access-list 103 deny ip 172.16.0.0 0.15.255.255 any
access-list 103 deny ip 192.168.0.0 0.0.255.255 any
access-list 103 deny ip 127.0.0.0 0.255.255.255 any
access-list 103 deny ip host 255.255.255.255 any
access-list 103 deny ip host 0.0.0.0 any
access-list 103 deny ip any any log
access-list 104 remark CCP_ACL Category=4
access-list 104 permit ip 10.133.10.0 0.0.1.255 any
access-list 105 remark CCP_ACL Category=4
access-list 105 remark IPSec Rule
access-list 105 permit ip 10.133.10.0 0.0.1.255 10.133.20.0 0.0.0.255
access-list 106 remark CCP_ACL Category=2
access-list 106 remark IPSec Rule
access-list 106 deny ip 192.168.10.0 0.0.1.255 10.133.34.0 0.0.1.255
access-list 106 remark IPSec Rule
access-list 106 deny ip 192.168.10.0 0.0.1.255 10.60.16.0 0.0.0.255
access-list 106 remark IPSec Rule
access-list 106 deny ip 10.133.10.0 0.0.1.255 10.60.16.0 0.0.0.255
access-list 106 remark IPSec Rule
access-list 106 deny ip 10.133.10.0 0.0.1.255 10.133.34.0 0.0.1.255
access-list 106 remark IPSec Rule
access-list 106 deny ip 10.133.10.0 0.0.1.255 10.133.20.0 0.0.0.255
access-list 106 permit ip 10.10.10.0 0.0.0.7 any
access-list 106 permit ip 10.133.10.0 0.0.1.255 any
access-list 107 remark CCP_ACL Category=4
access-list 107 remark IPSec Rule
access-list 107 permit ip 10.133.10.0 0.0.1.255 10.133.34.0 0.0.1.255
access-list 107 remark IPSec Rule
access-list 107 permit ip 192.168.10.0 0.0.1.255 10.133.34.0 0.0.1.255
access-list 108 remark Auto generated by SDM Management Access feature
access-list 108 remark CCP_ACL Category=1
access-list 108 permit tcp 10.133.10.0 0.0.1.255 host 10.133.10.1 eq telnet
access-list 108 permit tcp 10.133.10.0 0.0.1.255 host 10.133.10.1 eq 22
access-list 108 permit tcp 10.133.10.0 0.0.1.255 host 10.133.10.1 eq www
access-list 108 permit tcp 10.133.10.0 0.0.1.255 host 10.133.10.1 eq 443
access-list 108 permit tcp 10.133.10.0 0.0.1.255 host 10.133.10.1 eq cmd
access-list 108 deny tcp any host 10.133.10.1 eq telnet
access-list 108 deny tcp any host 10.133.10.1 eq 22
access-list 108 deny tcp any host 10.133.10.1 eq www
access-list 108 deny tcp any host 10.133.10.1 eq 443
access-list 108 deny tcp any host 10.133.10.1 eq cmd
access-list 108 deny udp any host 10.133.10.1 eq snmp
access-list 108 permit ip any any
access-list 109 remark CCP_ACL Category=1
access-list 109 permit ip 10.133.10.0 0.0.1.255 any
access-list 109 permit ip 10.10.10.0 0.0.0.7 any
access-list 109 permit ip 192.168.10.0 0.0.1.255 any
access-list 110 remark CCP_ACL Category=1
access-list 110 permit ip host 195.243.xxx.xxx any
access-list 110 permit ip host 84.44.xxx.xxx any
access-list 110 permit ip 10.133.10.0 0.0.1.255 any
access-list 110 permit ip 10.10.10.0 0.0.0.7 any
access-list 110 permit ip 192.168.10.0 0.0.1.255 any
access-list 111 remark CCP_ACL Category=4
access-list 111 permit ip 10.133.10.0 0.0.1.255 any
access-list 112 remark CCP_ACL Category=1
access-list 112 permit udp host 10.133.10.5 eq 1812 any
access-list 112 permit udp host 10.133.10.5 eq 1813 any
access-list 112 permit udp any host 10.133.10.1 eq non500-isakmp
access-list 112 permit udp any host 10.133.10.1 eq isakmp
access-list 112 permit esp any host 10.133.10.1
access-list 112 permit ahp any host 10.133.10.1
access-list 112 permit udp host 10.133.10.5 eq 1645 host 10.133.10.1
access-list 112 permit udp host 10.133.10.5 eq 1646 host 10.133.10.1
access-list 112 remark auto generated by CCP firewall configuration
access-list 112 permit udp host 10.133.10.5 eq 1812 host 10.133.10.1
access-list 112 permit udp host 10.133.10.5 eq 1813 host 10.133.10.1
access-list 112 permit udp host 10.133.10.7 eq domain any
access-list 112 permit udp host 10.133.10.5 eq domain any
access-list 112 deny ip 62.153.xxx.xxx 0.0.0.7 any
access-list 112 deny ip 10.10.10.0 0.0.0.7 any
access-list 112 deny ip host 255.255.255.255 any
access-list 112 deny ip 127.0.0.0 0.255.255.255 any
access-list 112 permit ip any any
access-list 113 remark CCP_ACL Category=1
access-list 113 remark IPSec Rule
access-list 113 permit ip 10.133.34.0 0.0.1.255 192.168.10.0 0.0.1.255
access-list 113 remark IPSec Rule
access-list 113 permit ip 10.60.16.0 0.0.0.255 192.168.10.0 0.0.1.255
access-list 113 remark IPSec Rule
access-list 113 permit ip 10.60.16.0 0.0.0.255 10.133.10.0 0.0.1.255
access-list 113 permit udp host 83.140.100.4 host 62.153.xxx.xxx eq non500-isakmp
access-list 113 permit udp host 83.140.100.4 host 62.153.xxx.xxx eq isakmp
access-list 113 permit esp host 83.140.100.4 host 62.153.xxx.xxx
access-list 113 permit ahp host 83.140.100.4 host 62.153.xxx.xxx
access-list 113 permit ip host 195.243.xxx.xxx host 62.153.xxx.xxx
access-list 113 permit ip host 84.44.xxx.xxx host 62.153.xxx.xxx
access-list 113 remark auto generated by CCP firewall configuration
access-list 113 permit udp host 194.25.0.60 eq domain any
access-list 113 permit udp host 194.25.0.68 eq domain any
access-list 113 permit udp host 194.25.0.68 eq domain host 62.153.xxx.xxx
access-list 113 permit udp host 194.25.0.60 eq domain host 62.153.xxx.xxx
access-list 113 permit udp any host 62.153.xxx.xxx eq non500-isakmp
access-list 113 permit udp any host 62.153.xxx.xxx eq isakmp
access-list 113 permit esp any host 62.153.xxx.xxx
access-list 113 permit ahp any host 62.153.xxx.xxx
access-list 113 permit ahp host 195.243.xxx.xxx host 62.153.xxx.xxx
access-list 113 permit esp host 195.243.xxx.xxx host 62.153.xxx.xxx
access-list 113 permit udp host 195.243.xxx.xxx host 62.153.xxx.xxx eq isakmp
access-list 113 permit udp host 195.243.xxx.xxx host 62.153.xxx.xxx eq non500-isakmp
access-list 113 remark IPSec Rule
access-list 113 permit ip 10.133.34.0 0.0.1.255 10.133.10.0 0.0.1.255
access-list 113 permit ahp host 62.20.xxx.xxx host 62.153.xxx.xxx
access-list 113 remark IPSec Rule
access-list 113 permit ip 192.168.10.0 0.0.1.255 10.133.10.0 0.0.1.255
access-list 113 permit esp host 62.20.xxx.xxx host 62.153.xxx.xxx
access-list 113 permit udp host 62.20.xxx.xxx host 62.153.xxx.xxx eq isakmp
access-list 113 permit udp host 62.20.xxx.xxx host 62.153.xxx.xxx eq non500-isakmp
access-list 113 remark IPSec Rule
access-list 113 permit ip 10.133.20.0 0.0.0.255 10.133.10.0 0.0.1.255
access-list 113 remark Pop3
access-list 113 permit tcp host 82.127.xxx.xxx eq 8080 host 62.153.xxx.xxx
access-list 113 remark Pop3
access-list 113 permit tcp any eq pop3 host 62.153.xxx.xxx
access-list 113 remark SMTP
access-list 113 permit tcp any eq 465 host 62.153.xxx.xxx
access-list 113 remark IMAP
access-list 113 permit tcp any eq 587 host 62.153.xxx.xxx
access-list 113 deny ip 10.133.10.0 0.0.1.255 any
access-list 113 deny ip 10.10.10.0 0.0.0.7 any
access-list 113 permit icmp any host 62.153.xxx.xxx echo-reply
access-list 113 permit icmp any host 62.153.xxx.xxx time-exceeded
access-list 113 permit icmp any host 62.153.xxx.xxx unreachable
access-list 113 deny ip 10.0.0.0 0.255.255.255 any
access-list 113 deny ip 172.16.0.0 0.15.255.255 any
access-list 113 deny ip 192.168.0.0 0.0.255.255 any
access-list 113 deny ip 127.0.0.0 0.255.255.255 any
access-list 113 deny ip host 255.255.255.255 any
access-list 113 deny ip host 0.0.0.0 any
access-list 113 deny ip any any log
access-list 114 remark auto generated by CCP firewall configuration
access-list 114 remark CCP_ACL Category=1
access-list 114 deny ip 10.133.10.0 0.0.1.255 any
access-list 114 deny ip 10.10.10.0 0.0.0.7 any
access-list 114 permit icmp any any echo-reply
access-list 114 permit icmp any any time-exceeded
access-list 114 permit icmp any any unreachable
access-list 114 deny ip 10.0.0.0 0.255.255.255 any
access-list 114 deny ip 172.16.0.0 0.15.255.255 any
access-list 114 deny ip 192.168.0.0 0.0.255.255 any
access-list 114 deny ip 127.0.0.0 0.255.255.255 any
access-list 114 deny ip host 255.255.255.255 any
access-list 114 deny ip host 0.0.0.0 any
access-list 114 deny ip any any log
access-list 115 remark VPN_Sub
access-list 115 remark CCP_ACL Category=5
access-list 115 permit ip 10.133.10.0 0.0.1.255 172.16.0.0 0.0.255.255
access-list 115 permit ip 10.133.34.0 0.0.1.255 172.16.0.0 0.0.255.255
access-list 115 permit ip 10.133.20.0 0.0.0.255 any
access-list 116 remark CCP_ACL Category=4
access-list 116 remark IPSec Rule
access-list 116 permit ip 10.133.10.0 0.0.1.255 10.60.16.0 0.0.0.255
access-list 117 remark CCP_ACL Category=4
access-list 117 remark IPSec Rule
access-list 117 permit ip 10.133.10.0 0.0.1.255 10.60.16.0 0.0.0.255
access-list 118 remark CCP_ACL Category=4
access-list 118 remark IPSec Rule
access-list 118 permit ip 10.133.10.0 0.0.1.255 10.60.16.0 0.0.0.255
access-list 118 remark IPSec Rule
access-list 118 permit ip 192.168.10.0 0.0.1.255 10.60.16.0 0.0.0.255
no cdp run
route-map SDM_RMAP_1 permit 1
match ip address 106
control-plane
mgcp profile default
line con 0
transport output telnet
line 1
modem InOut
speed 115200
flowcontrol hardware
line aux 0
transport output telnet
line vty 0 4
session-timeout 45
access-class 110 in
transport input telnet ssh
line vty 5 15
access-class 109 in
transport input telnet ssh
scheduler interval 500
endThe crypto ACL for the site to site vpn should also include the vpn client pool, otherwise, traffic from the vpn client does not match the interesting traffic for the site to site vpn.
On Site A:
should include "access-list 107 permit ip 172.16.100.0 0.0.0.255 10.133.34.0 0.0.1.255"
You should also remove the following line as the pool is incorrect:
access-list 107 permit ip 192.168.10.0 0.0.1.255 10.133.34.0 0.0.1.255
On Site B:
should include: permit ip 10.133.34.0 0.0.1.255 172.16.100.0 0.0.0.255"
NAT exemption on site B should also be configured with deny on the above ACL. -
Cisco 3905 problem / remote site
Hi all!
Information:
I have CUCM 8.6.2.20000-2 and many Cisco IP Phone 3905 (SIP). Some of them deployed in central office and some in remote sites.
Phone information:
Boot Version: 3905.0-0-0-01-01
DSP Version: 12.0.0.8
Application: 3905.9-2-2-0
Symptoms:
In remote sites only!
The phone is registered and working fine. However, after few hours idle state I lift the handset, dial any number and nothing happens. Drop the call and try again 2-3 times. After that either call passed or get permanent busy tone (need to reboot the phone to work again).
The phone is marked as registered on CUCM and I hear dial tone when lifted the handset.
I cannot collect debug messages from phones, because as soon as I login via telnet it going work fine.
There is no such problem in central office.
Phones print following messages in terminal all the time:
17:07:10:302 x [CENTRAL] CDP/LLDP-MED CB function is called
17:07:26:491 [sip] 03:58:24.490 pjsua_acc.c SIP outbound status for acc 0 is not active
17:07:26:495 [sip] 03:58:24.494 pjsua_acc.c "п°п╦я┘п╟п╦п╩ п я┐пЇя▄п╪п╦пҐ"<sip:[email protected]:5060>: registration success, status=200 (OK ), will re-register in 120 seconds
17:07:26:502 [sip] 03:58:24.500 pjcu.c pjcu_on_reg_state2(), Account["п°п╦я┘п╟п╦п╩ п я┐пЇя▄п╪п╦пҐ"<sip:[email protected]:5060>] : OK, status=200
17:07:26:506 x [pcu] pcuRcvHandler(CALL), SRV_EV, eid=0, cid=65535,
17:07:26:510 x [pcu] [pcux_insrv_cb():7071] CUCM_DateTime:Mon, 27 May 2013 11:07:26 GMT
17:07:26:511 x [pcu] Sync time from server: Mon, 27 May 2013 11:07:26 GMT
17:07:26:515 x [pcu] [set_svr_type][1599] Bfe active_server_idx=0, serverType=0
17:07:26:515 x [pcu] [set_svr_type][1602] Aft serverType=0, Server Number=2
17:07:26:531 [ipps] ----- PCU: CC_SRV, pid=0, eid=0, cid=65535 -----
17:07:26:532 [ipps] In func: remoteNtyEvtProcess(), lib = 0, cid = 65535, ntyEv = 0
17:07:26:533 f [ipps] In func: remoteNtyEvtProcess(), recv inservice nty, svrType = 0, cause = 0
17:07:26:534 f [MMI] <RCV>: In func: ui_nty(), lid = 0, cid = 65535, ntyEv = 0
17:07:26:535 x [CENTRAL] IPPS CB function(RegStatus) is called (1) with Line (0)
17:07:26:536 f [ipps] In func: mlcu_isKpmlEnabled(), KPML value = 3, blRet = 1
17:07:26:537 x [CENTRAL] Enter FSM: State(STANDBY) | Event(REGISTER_OK) | Cause(0)
17:07:26:540 x [CENTRAL] Unexpected event REGISTER_OK (cause=0) at STANDBY state
17:07:26:541 x [CENTRAL] Waiting event in STANDBY
17:07:58:990 x [CENTRAL] CDP/LLDP-MED CB function is called
17:08:39:022 [sip] 03:59:37.021 pjcu.c pjcuRcvHandler(KA), KA_REQUEST, eid=-1, p1=192.168.70.1:5060
17:08:39:040 [sip] 03:59:37.036 pjcu.c pjcu_rpt_ka_status(), target(192.168.70.1:5060): status=1, id=27
17:08:39:044 x [pcu] pcuRcvHandler(KA), KA_RESPONSE, eid=0, addr=192.168.70.1:5060, status=1
17:08:39:050 x [pcu] [pcu_polling_sipserver_thread():1478] mark!
17:08:54:130 x [CENTRAL] CDP/LLDP-MED CB function is called
Thanks for your help.There are 2 versions of firmware on cisco.com. cmterm-3905.9-2-1-0 is the default firmware going with CUCM 8.6.2.20000-2 for 3905 phones and cmterm-3905.9-2-2-0 I've installed recently. Both versions of firmware with same problems.
Some new information. I get traffic dump with wireshark.
INVITE sip:[email protected]:5060;transport=tcp SIP/2.0
Via: SIP/2.0/TCP 192.168.70.86:3457;rport;branch=z9hG4bKPjdp3HjFLs7Dy03RL9ce.16qung.tOq5O3
Max-Forwards: 70
From: "............ .............." ;tag=5a25b465-747b-4c31-a020-1a9636827427
To: sip:[email protected]
Contact: ;+sip.instance="";+u.sip!devicename.ccm.cisco.com="SEP10BD18DD3F59";+u.sip!model.ccm.cisco.com="592"
Call-ID: e9edcc43-6a9b-42b8-8efc-99f702b313d1
CSeq: 28324 INVITE
Allow: PRACK, INVITE, ACK, BYE, CANCEL, UPDATE, SUBSCRIBE, NOTIFY, REFER, MESSAGE, OPTIONS
User-Agent: Cisco-CP3905/9.2.1
Supported: replaces,join,sdp-anat,norefersub,extended-refer,X-cisco-callinfo,X-cisco-serviceuri,X-cisco-escapecodes,X-cisco-service-control,X-cisco-monrec,X-cisco-config,X-cisco-sis-4.0.0,X-cisco-xsi-7.0.1
Expires: 900
Accept: application/sdp
Allow-Events: kpml,dialog
Remote-Party-ID: "............ ..............";privacy=off
Content-Type: application/sdp
Content-Length: 294
As you can see phone trying to invite [email protected]:5060, BUT I dial 7103 DN from 7102. So where are other numbers? Bug? -
Remote site redundancy IPSEC VPN between 2911 and ASA
We already have IPSEC VPN connectivity established between sites but would like to introduce some resilience/redundancy at a remote site.
Site A has an ASA with one internet circuit.
Site B has a Cisco 2911 with one internet circuit and we have established site-to-site IPSEC VPN connectivity between the 2911 and the ASA.
Prior to getting the new internet circuit, Site B had a Cisco 877 with an ADSL line which are still available but aren’t currently in use.
The internet circuit at Site B has dropped a few times recently so we would like to make use of the ADSL circuit (and potentially the 877 router too) as a backup.
What is the best way of achieving this?
We thought about running HSRP between the 877 and 2911 routers at Site B and, in the event of a failure of the router or internet circuit, traffic would failover to the 877 and ADSL.
However, how would Site A detect the failure? Can we simply rely on Dead Peer Detection and list the public IP address of the internet circuit at Site B first with the public IP address used on the ADSL line second in the list on the ASA? What would happen in a failover scenario and, just as important, when service was restored – I’m not sure DPD would handle that aspect correctly?
I’ve read briefly elsewhere that GRE might be best to use in this scenario – but I can’t use GRE on the ASA. I have an L3 switch behind the ASA which I may be able to make use of? But I don’t want to disrupt the existing IPSEC VPN connectivity already established between the ASA and the 2911. Can I keep IPSEC between the ASA and 2911 but then run GRE between the L3 switch and the 2911? If so, how would this best be achieved? And how could I also introduce the 877 and ADSL line into things to achieve the neccessary redundancy?
Any help/advice would be appreciated!Hello,
I don't think GRE tunnel that you could set up on the switch behind ASA would be really helpfull. Still site-2-site tunnel you want to establish between ASA and some routers, but still it is ASA which needs to make decision about which peer to connect to.
Possible solution would be to do HSRP between both routers on LAN side and with two independent tunnels/crypto maps (one on each of them). On ASA you would need to set up two hosts in set peer. Problem of this solution is that if one router at side B is going to go down and second ADSL line will take over ASA will not do preempt after you main Internet connection is up again. This would happen after ADSL Internet connection will be down.
Solution to that would be to assign two different public IP addressess on two different interfaces of ASA. Then you attach two crypto maps to both interfaces and by using sla monitor (let's say icmp to main router, if it does not respond then you change routing for remote LAN to second interface) you are selecting which crypto map (with one peer this time) should be used.
I hope what I wrote makes some sense. -
Using a view to join two tables
Thank you in advance for any advice you can lend.
I am using this code in my MySQL db to create a view.
select
job.id as job_id,
umr_cost_calculation.plant_name,
max(umr_cost_calculation.id) as max_id
from
job,
umr_cost_calculation
where
job.id = umr_cost_calculation.job_id
group by job.id , umr_cost_calculation.plant_name
I did this so I can join two tables and pull in the most current cost data for a specific plant. The report will, at times, show the wrong (older) data. I can re-run the report, filter to just the one job and see again the wrong data. When I add the max_id to the report, it display the id and updates the report with the correct data. It appears that the view was stale and by adding the ID to the report this fixed the issue.
1) Is this the best way to make this join? I don't see how Crystal supports a subquery to make a join (this is why I used the view).
2) If I leave the max_id on the report, will this force the view to always update?Try:
Select
D1.EmpLoginID,
Count(D1.ID),
Count(D1.AlarmCode),
D1.EmpName,
D1.EmpAddress,
D2.Db2Count
FROM DB1.Data D1
LEFT JOIN (SELECT
empLoginID, Count(*) as Db2Count
FROM DB2.ALL_Database
WHERE site = 'Atlanta'
GROUP BY empLoginID
) D2
ON D1.EmpLoginID = D2.EmpLoginID
GROUP BY D1.empLoginID, D1.EmpName, D2.EmpAddress, D2.Db2Count
Order BY D1.empLoginID ASC
For every expert, there is an equal and opposite expert. - Becker's Law
My blog
My TechNet articles -
Best Practice for SRST deployment at a remote site
What is the best practice for a SRST deployment at a remote site? Should a separate router such as a 3800 series be deployed for telephony in addition to another router to be deployed for Data? Is there a need for 2 different devices?
Hi Brian,
This is typically done all on one ISR Router at the remote site :)There are two flavors of SRST. Here is the feature comparison;
SRST Fallback
This feature enables routers to provide call-handling support for Cisco Unified IP phones if they lose connection to remote primary, secondary, or tertiary Cisco Unified Communications Manager installations or if the WAN connection is down. When Cisco Unified SRST functionality is provided by Cisco Unified CME, provisioning of phones is automatic and most Cisco Unified CME features are available to the phones during periods of fallback, including hunt-groups, call park and access to Cisco Unity voice messaging services using SCCP protocol. The benefit is that Cisco Unified Communications Manager users will gain access to more features during fallback ****without any additional licensing costs.
Comparison of Cisco Unified SRST and
Cisco Unified CME in SRST Fallback Mode
Cisco Unified CME in SRST Fallback Mode
⢠First supported with Cisco Unified CME 4.0: Cisco IOS Software 12.4(9)T
⢠IP phones re-home to Cisco Unified CME if Cisco Unified Communications Manager fails. CME in SRST allows IP phones to access some advanced Cisco Unified CME telephony features not supported in traditional SRST
⢠Support for up to 240 phones
⢠No support for Cisco VG248 48-Port Analog Phone Gateway registration during fallback
⢠Lack of support for alias command
⢠Support for Cisco Unity® unified messaging at remote sites (Distributed Exchange or Domino)
⢠Support for features such as Pickup Groups, Hunt Groups, Basic Automatic Call Distributor (BACD), Call Park, softkey templates, and paging
⢠Support for Cisco IP Communicator 2.0 with Cisco Unified Video Advantage 2.0 on same computer
⢠No support for secure voice in SRST mode
⢠More complex configuration required
⢠Support for digital signal processor (DSP)-based hardware conferencing
⢠E-911 support with per-phone emergency response location (ERL) assignment for IP phones (Cisco Unified CME 4.1 only)
Cisco Unified SRST
⢠Supported since Cisco Unified SRST 2.0 with Cisco IOS Software 12.2(8)T5
⢠IP phones re-home to SRST router if Cisco Unified Communications Manager fails. SRST allows IP phones to have basic telephony features
⢠Support for up to 720 phones
⢠Support for Cisco VG248 registration during fallback
⢠Support for alias command
⢠Lack of support for features such as Pickup Groups, Hunt Groups, Call Park, and BACD
⢠No support for Cisco IP Communicator 2.0 with Cisco Unified Video Advantage 2.0
⢠Support for secure voice during SRST fallback
⢠Simple, one-time configuration for SRST fallback service
⢠No per-phone emergency response location (ERL) assignment for SCCP Phones (E911 is a new feature supported in SRST 4.1)
http://www.cisco.com/en/US/prod/collateral/voicesw/ps6788/vcallcon/ps2169/prod_qas0900aecd8028d113.html
These SRST hardware based restrictions are very similar to the number of supported phones with CME. Here is the actual breakdown;
Cisco 880 SRST Series Integrated Services Router
Up to 4 phones
Cisco 1861 Integrated Services Router
Up to 8 phones
Cisco 2801 Integrated Services Router
Up to 25 phones
Cisco 2811 Integrated Services Router
Up to 35 phones
Cisco 2821 Integrated Services Router
Up to 50 phones
Cisco 2851 Integrated Services Router
Up to 100 phones
Cisco 3825 Integrated Services Router
Up to 350 phones
Cisco Catalyst® 6500 Series Communications Media Module (CMM)
Up to 480 phones
Cisco 3845 Integrated Services Router
Up to 730 phones
*The number of phones supported by SRST have been changed to multiples of 5 starting with Cisco IOS Software Release 12.4(15)T3.
From this excellent doc;
http://www.cisco.com/en/US/prod/collateral/voicesw/ps6788/vcallcon/ps2169/data_sheet_c78-485221.html
Hope this helps!
Rob -
This is a newbie question! I would like to join two tables. Table_1 contains xml stylesheets:
id stylesheet doc
1 <xml stylesheet doc A>
2 <xml stylesheet doc B>
And Table_2 contains the XML documents that the stylesheets will transform:
id XML doc
1 <XML document 1>
1 <XML document 2>
1 <XML document 3>
2 <XML document 4>
2 <XML document 5>
I would like <xml stylesheet doc A> to transform only XML doc that have an id of 1, so I tried this sql statement:
select a.stylesheet_doc ,b.xml_doc from Table_1 a, Table_2 b where a.id=b.id and a.id=1;
This statement returns the rows I want (stylesheet doc with id equals 1, and xml_doc with id equals 1), but it pairs each xml document with a style sheet.
stylesheet doc A <XML document 1>
stylesheet doc A <XML document 2>
stylesheet doc A <XML document 3>
My question is, is there a way to have a result that looks like this?
stylesheet doc A
<XML document 1>
<XML document 2>
<XML document 3>
That is, is there a way in sql to get rid of duplicate stylesheet doc A?
I have tried group by and rollup and xmlagg.
Thank you very, very much for your help.
JimHi, Jim,
Welcome to the forum!
You just want to display the XML, not actually transform it, right?
GROUP BY ROLLUP should work, but I find it easier with GROUP BY GROUPING SETS. Here's an example from tables in the scott schema:
SELECT CASE
WHEN GROUPING (ename) = 1
THEN d.dname
END AS dname
, e.ename
FROM scott.dept d
JOIN scott.emp e ON d.deptno = e.deptno
GROUP BY GROUPING SETS ( (d.dname, e.ename)
, (d.dname)
ORDER BY d.dname
, ename NULLS FIRST
;Output:
DNAME ENAME
ACCOUNTING
CLARK
KING
MILLER
RESEARCH
ADAMS
FORD
JONES
SCOTT
SMITH
SALES
ALLEN
BLAKE
JAMES
MARTIN
TURNER
WARDYou may have noticed that this site noramlly compresses whitespace.
Whenever you post formatted text (such as query results) on this site, type these 6 characters:
\(small letters only, inside curly brackets) before and after each section of formatted text, to preserve spacing. -
Adding a Server 2008 R2 Domain Controller at a remote site
Hello. I have been trying to set up a hot site at a remote location. The story is long and involved but a few weeks ago it seemed to be finally working. Our setup is two mirrored 2008 R2 servers at main site, mirrored with Double Take.
The hot site is the same except that so far I only had one server working. The two sites connected via site to site VPN.
About a week later our primary server basically crashed. At first it worked but very slowly. I was on vacation at the time and so I am not sure of the sequence of events, or exactly what errors were presented, but my associate first tried rebooting.
It took over 20 minutes to boot and then it said something to the effect that no domain controllers were available (not sure about this message). He then discovered that the server at the remote site had some fsmo roles assigned to it. He transferred
the roles to the primary at the main site and then demoted the remote server to a workstation (but still a domain member).
After that, rebooting the primary was much faster and everything at the primary site is working again. Now I want to set the remote site up again, but avoid the problem. The way I originally set up the remote server was to use an IFM file, generated
from our primary. This should have made the remote server a catalog server, with DNS (which it did), but as far as I know should not have transferred any fsmo roles.
The remote server(s) are wanted to be in the same domain as the primary. They will also be mirrored from the primary (with Double Take). If we had total failure at the main site, we wish to be able to immediately begin operations at the hot site
(after a fail over). I freely admit that I am swimming out of my depth here. I am not sure that I have selected the correct architecture or used the correct options in setting up the remote servers. I am looking for information about what
went wrong, and whether some other setup is more desirable.
Thanks for any help, Russ
RussPhilippe, thank you for you answers. I do not understand everything you said but I will address each point as best I can:
1. "In the remote site do you simply do a dcpromo / add the ADDS's role to make the server a active Domain Controller ?" Yes, but I use the method described at
http://technet.microsoft.com/en-us/library/cc753720(v=ws.10).aspx, The GUI method. At step #8 I specified to use advanced mode so I could use the IFM file.
2. "In your AD' Site and Service MMC, do you configured the remote site ?" R do not know what you mean by this. How does one configure the site as 'remote'?
3. "Do you added that remote server as a Global catalogue ?". Yes, when I built the IFM file I specified to add the global catalog.
4. "Do you added the PC in site 1, the IP of those DNS server in them ? (last of course) So the computer in the main site will talk to the remote server in case of a crash." I am not sure I understand this item. After the remote server
was added, all of the members of both domain servers automatically appeared in the DNS of all servers in the domain. I do not recall if the new items were last, but I expect that they would be.
I have since reviewed the happenings with my associate and have a little more information. The order of the problems and the actions taken are:
1. Our primary (production) system was still working but extremely slow, and he observed that the slowness was caused by a lot of traffic with the remote site. Rebooting the production server took over 25 minutes and the server to came up saying
that domain information was not available. After another 30 minutes or so he discovered that the domain data was now available and the server worked, but still slow.
2. He did not check to verify that roles were held by the remote server, but he transferred all roles from the remote to the production server using ntdsutil. I would expect that if the role was not held by the remote, the transfer command would have
shown that fact.
3. He then tried to demote the remote server but had an error that it could not be demoted because "the active directory service is missing mandatory configuration information".
4. He forcefully demoted the remote server.
5. After rebooting the production server again performance was slightly better but still slow (and the rebood was still very slow).
6. After some research he removed the remote domain controller's meta data from the production server and then rebooted the production server again.
At that point reboot was fast (under 5 minutes) and the production system was working at normal speed again.
All of the above leads me to believe that somehow the FSMO roles got added to, or moved to the remote site when I used the IFM file to create the new domain controller. However nothing I have read says that this should happen. I hope someone
here can give me a better answer as to what caused the problem, as I do not wish to interrupt our production system like this again.
Thank you, Russ
PS: Sorry for the delay in getting back to this but some other priorities took me away from it for a week.
Russ -
Losing connection to the Domain Controllers at a remote site
We have a remote site with a IPsec tunnel for a site to site connection and there are about a dozen window 7 systems on site. Every 3 to 5 weeks, the systems start to lose the ability to log into the domain. Running some tests, the DNS names
keep resolving, their subnet is setup in Sites and Services to the group with the DC's and they are setup correctly for IP settings but seems like they still can't connect back to the DC's. From there, under network profiles, it says the domain network
is unauthenticated.
The only way we have found to fix this is to dis-join the computer from the domain and rejoin it.
Is there a way from the computer to force it to re-authenticate without having to do this or a better fix?Hello Technsopyder,
Do you means all the Windows 7 use the IPsec will lose connection to the Domain Controllers every 3 to 5 weeks?
Do you receive the error code 5719 and 3210? Could you please provide the whole error message?
Please check if you need to change the password before this issue as Brano Lukic mentioned.
Best regards,
Fangzhou CHEN
Fangzhou CHEN
TechNet Community Support -
I have a main site with ccm 4.1 in a full cisco environment. working perfectly. this main site has two external links: E1 for PSTN and a broadband on fiber 6Mbps.
I have a remote site with about 10 users, with a broadband link 2Mbps symetric.
I configured a plain ipsec VPN between the remote router (2621 12.2(17) ) and the PIX of the main site (6.2).
IP phones of the remote site work fine.
However, at times, audio is lost. I have Qos on the 2621 and "show policy-map int fa 0/0" does not show dropped packets.
Is this the best configuration ?
Should I use the 2621 as a MGCP Gateway instead ? a H323 gateway instead ?
what are the main criteria for these choices ?
thnak you.I have less than 20 ms between routers and 22 ms within the ipsec tunnel.
It's good to me. -
Partition ERROR - 1023040 - msg from remote site : need to understand
hi,
I currently have a problem with the partitions between two cubes.
Architecture:
80 countries database (source)
1 world database (destination)
Process :
- The partitions are created dynamically by maxl scripts :
spool on to $1;
Alter application $2 comment '**_batch_**';
Alter application $4 comment '**_batch_**';
Alter system load application $2;
Alter system load application $4;
Alter application $2 disable startup;
Alter application $4 disable startup;
Alter application $2 disable connects;
Alter application $4 disable connects;
/* Create Transparant Partition between Country cube to Mond cube */
create or replace replicated partition $2.$3
AREA
'"S_R_N",
&curr_month,
&local_currency, "D_EURO",
@IDESCENDANTS("P_Produit"),
@LEVMBRS("M_Marche",1),"M_Marche",
@IDESCENDANTS("B_Marque"),
@IDESCENDANTS("U_Sourcing"),
@REMOVE (@DESCENDANTS("I_Masse"), @LIST ("I_55CCOM")), @DESCENDANTS("I_Divers"),
@IDESCENDANTS("NA_Nature"),MCX'
to $4.$5
AREA
'"S_R_N",
&curr_month,
"D_DEV", "D_EUR",
@IDESCENDANTS("P_Produit"),
@LEVMBRS("M_MixClient",0),"M_MixClient",
@IDESCENDANTS("B_Marque"),
@IDESCENDANTS("U_Sourcing"),
@REMOVE (@DESCENDANTS("I_Masse"), @LIST ("I_55CCOM")), @DESCENDANTS("I_Divers"),
@IDESCENDANTS("NA_Nature"),MCX,
&country_name'
mapped globally ('',D_$7, "D_EURO", "M_Marche") to (W_$6,D_DEV, "D_EUR", "M_MixClient")
refresh replicated partition $2.$3 to $4.$5 all data;
drop replicated partition $2.$3 to $4.$5;
Alter application $2 enable startup;
Alter application $4 enable startup;
Alter application $2 enable connects;
Alter application $4 enable connects;
Alter application $2 comment '**_enable_**';
Alter application $4 comment '**_enable_**';
Alter system unload application $2;
Alter system unload application $4;
Spool off;
Logout;
exit;
- Defragmentation cubes, launch replications countries successively one by one to the world cubes sequentially .
the order of the country is not the same from one month to another .
Treatment is initiated each month.
Symptoms :
- Partition fall into error with the following message but not systematically .
message:
MAXL > refresh replicated partition PGC_ESP.Pgc_esp PGC_MOND.Pgc_mond to all data ;
ERROR - 1023040 - msg from remote site [ [ Wed Nov. 29 10:21:03 2013] hprx1302/PGC_MOND/Pgc_mond/PGC_ADMIN/Error ( 1023040 ) msg from remote site [ [ Wed Nov. 29 10:21:02 2013] hprx1302 / PGC_ESP / Pgc_esp / PGC_ADMIN / Error (1023040) msg from remote site [ [ Wed Nov. 29 10:21:01 2013] hprx1302/PGC_MOND/Pgc_mond/PGC_ADMIN/Error ( 1042012 ) Network error [ 32] : Can not Send Data ]]] .
We note that the error occurs in the following cases:
- The errerur happens generally when the average clustering ratio is low. (cube fragmented) for cubes source and / or destination
- When beacuoup replication were done before: in the last 10 to 15 cubic remaining replicate.
- We mistake once on the environment recipe on the first cube with average clustering ratio to 0.96 but the server recipe is much less efficient.
We noticed that when doing a defragmentation cubes source and destination once the error obtained treatment replication was no longer falling into error.
Problem: defragmentation cube world take 10 hours.
We also made the following observation:
OK/INFO - 1051034 - Logging in user [PGC_ADMIN].
OK/INFO - 1051035 - Last login on Friday, November 29, 2013 10:19:46 AM.
OK/INFO - 1053012 - Object [Pgc_esp] is locked by user [PGC_ADMIN].
OK/INFO - 1053012 - Object [Pgc_mond] is locked by user [PGC_ADMIN].
OK/INFO - 1053012 - Object [54116855] is locked by user [PGC_ADMIN].
OK/INFO - 1053012 - Object [39843334] is locked by user [PGC_ADMIN].
OK/INFO - 1053013 - Object [54116855] unlocked by user [PGC_ADMIN].
OK/INFO - 1053013 - Object [39843334] unlocked by user [PGC_ADMIN].
WARNING - 1241137 - [Target] - Partition definition is not valid: [Cell count mismatch: [1279464568200] area for slice [1] members per dimension [63 1 2 1 6 26 7 245 1 37955 ]].
OK/INFO - 1053012 - Object [25586652] is locked by user [PGC_ADMIN].
OK/INFO - 1053012 - Object [11329970] is locked by user [PGC_ADMIN].
OK/INFO - 1053013 - Object [25586652] unlocked by user [PGC_ADMIN].
OK/INFO - 1053013 - Object [11329970] unlocked by user [PGC_ADMIN].
WARNING - 1241137 - [Source] - Partition definition is not valid: [Cell count mismatch: [47895484140] area for slice [1] members per dimension [63 1 6 7 2173 2 17 1 245 ]].
OK/INFO - 1053013 - Object [Pgc_esp] unlocked by user [PGC_ADMIN].
OK/INFO - 1053013 - Object [Pgc_mond] unlocked by user [PGC_ADMIN].
OK/INFO - 1051037 - Logging out user [PGC_ADMIN], active for 0 minutes.
OK/INFO - 1241124 - Partition replaced.
Following these findings we need to understand what is happening.
We would like to understand why partitons fall errors?
why we have the message "Partition definition is not valid" in the logs when creating the partition?
Regards,
Oliv.Hi SreekumarHariharan,
Tx to your anwers, but we are already try all the solution proposes to Essbase FAQ.
a)Increase the values for NETDELAY and NETRETRYCOUNT in essbase.cfg file.Restart the essbase server.
We are changed the two value in the essbase.cfg but nothing to do. The same error appears
b)Make sure that the all source members and target members used in partition are in sync
All member are diferent between source and target but a mapping are defined in the partition (see the partition maxl in my below message.
c)Validate the partition (look at the validation tab, it will give the numbers for each side of the partition ie source area and target area)
You can see the logs of validation partition :
WARNING - 1241137 - [Target] - Partition definition is not valid: [Cell count mismatch: [1279464568200] area for slice [1] members per dimension [63 1 2 1 6 26 7 245 1 37955 ]].
OK/INFO - 1053012 - Object [25586652] is locked by user [PGC_ADMIN].
OK/INFO - 1053012 - Object [11329970] is locked by user [PGC_ADMIN].
OK/INFO - 1053013 - Object [25586652] unlocked by user [PGC_ADMIN].
OK/INFO - 1053013 - Object [11329970] unlocked by user [PGC_ADMIN].
WARNING - 1241137 - [Source] - Partition definition is not valid: [Cell count mismatch: [47895484140] area for slice [1] members per dimension [63 1 6 7 2173 2 17 1 245 ]].
OK/INFO - 1053013 - Object [Pgc_esp] unlocked by user [PGC_ADMIN].
OK/INFO - 1053013 - Object [Pgc_mond] unlocked by user [PGC_ADMIN].
OK/INFO - 1051037 - Logging out user [PGC_ADMIN], active for 0 minutes.
OK/INFO - 1241124 - Partition replaced.
d)Rerun the Partition script again
The same error appears.
Tx to your help.
Regards,
Oliv. -
Join two list of integer type field using CAML query
Hi
As i am struggling in Join two sharepoint list (Roles and Emplyees). As there is no lookup columns and lists are already existing and have almost 3000 + recodrs. As a part of enhancement work need to join these list. List structure is some thing as follows:
Roles :
ID Title
1 Project Manager
2 Business Analyst
3 Developer
Employees :
Name Role
1 James 1
2 Petar 3
3 John 2
Output should be like as follows:
Name Role
1 James Project Manager
2 Petar Developer
3 John Developer
So please suggest, if the joining can be done other than lookup columns through the CAML query.
Akhilesh RaoFollow below CAML query to add joins between two lists.
SPList list = SPContext.Current.Site.RootWeb.Lists["Employees"];
SPQuery query = new SPQuery();
query.Joins = @" <Join Type="INNER" ListAlias="Roles">
<Eq>
<FieldRef Name="Employees" RefType="Role" />
<FieldRef List="Roles" Name="ID" />
</Eq>
</Join>";
query.ProjectedFields = @" <Field Name="RoleName" Type="Lookup" List="Roles" ShowField="Title">";
query.ViewFields = @ "<FieldRef Name="Title">
<FieldRef Name="RoleName"> ";
SPListItemCollection result = tablea.GetItems(query);
Adnan Amin MCT, SharePoint Architect | If you find this post useful kindly please mark it as an answer :)
Maybe you are looking for
-
My laptop is running on windows 7 and my pc on xp, both of them only fin my ipod touch as a camera even in new version of itunes. How do i solve this?
-
Special KB characters change when sending
Like the function to just tap the letter, hold it and you get the other characters, but once you sending off the message, it changes back to the actual letter. Why?
-
Song order in itunes is out of order, can't fix with get info as apple suggests
I recently got a new 160gb Ipod and noticed when i synced with my itunes library that a lot of my albums are out of order. looked around trying to fix myself, but the suggestion to go to 'get info' tab and fix song order is not working. Noticed that
-
How to use selection creteria in Trial Balance ???....
Dear all, Redefining my question in another thread, How to use selection creteria in Trial balance to get closing balance of previous fiscal year as opening balance of current fiscal year(01.04.09 to till date) ? Since Revenue,Expenditure account get
-
I'm trying to move some files off my old PCI PowerMac.
But I've discovered that every time I try to copy to or from the flash drive, the system hangs on Mac OS 9.1 (the last officially supported version for this Mac) and I have to reboot, which is getting me nowhere. I can't network two Macs together; I