About 2950 acl configuration

I have a c2950 and want to config acl. I enter INTERFACE MODE and issue IP ACCESS-GROUP command ,But system prompt no this command . how can I do. Please help me . Issuing show ver command.Message as fallows.
Cisco Internetwork Operating System Software
IOS (tm) C2950 Software (C2950-I6K2L2Q4-M), Version 12.1(22)EA6, RELEASE SOFTWARE (fc1)
Copyright (c) 1986-2005 by cisco Systems, Inc.
Compiled Fri 21-Oct-05 02:22 by yenanh
Image text-base: 0x80010000, data-base: 0x80676000
ROM: Bootstrap program is C2950 boot loader
tycib_sw29_f2office2 uptime is 3 minutes
System returned to ROM by power-on
System image file is "flash:/c2950-i6k2l2q4-mz.121-22.EA6.bin"
This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.
A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
If you require further assistance please contact us by sending email to
[email protected].
cisco WS-C2950-24 (RC32300) processor (revision R0) with 19973K bytes of memory.
Processor board ID FOC0935Z7SN
Last reset from system-reset
Running Standard Image
24 FastEthernet/IEEE 802.3 interface(s)
32K bytes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address: 00:15:62:63:5D:C0
Motherboard assembly number: 73-5781-13
Power supply part number: 34-0965-01
Motherboard serial number: FOC09343GDK
Power supply serial number: DAB0930DP48
Model revision number: R0
Motherboard revision number: A0
Model number: WS-C2950-24
System serial number: FOC0935Z7SN
Configuration register is 0xF

Hi There,
Your switch WS-C2950-24, is a switch with standard image i.e SMI. This image doenot support ACL's and that's why its not working. You should have a 2950 with EMI to run ACLs. This switch is not upgradable to EMI so you really cannot use ACLs on this :(.
http://www.cisco.com/en/US/products/hw/switches/ps628/products_data_sheet09186a00801cfb71.html
regards,
-amit singh

Similar Messages

Acl configuration

Hello everyone,
I have a doubt about the ACL configuring in my ASA
I have this acl witch it means that 10.10.11.2 can do www to the host 10.10.10.1
access-list 100 extended permit tcp host 10.10.11.2 host 10.10.10.1 eq www
and
access-list 100 extended permit tcp host 10.10.10.1 eq www host 10.10.11.2 (hitcnt=31)
witch it means that the host 10.10.10.1 can make www to the host 10.10.11.2
the host 10.10.10.1 can't do www to the host 10.10.11.2, but the host 10.10.11.2 can do, and the second ACL have hits.
is ti right?
Thanks.

If you want to allow hosts 10.10.10.1 to hit 10.10.11.2 on www then you should change the syntax to:
access-list 100 extended permit tcp host 10.10.10.1 host 10.10.11.2 eq www
Your original syntax:
access-list 100 extended permit tcp host 10.10.10.1 eq www host 10.10.11.2
By placing the "eq www" after the source IP, you are telling the ASA that the source port is 80/www. Instead, you want the destination port to be "80/www" and as a result, you need to place is after the destination IP.
Also, you can always use the "packet-tracer" command to see exactly what is blocking your traffic :)
Thank you for rating helpful posts!

ACL - configuration help

Hello I've a newly configured 5510 would appreciate a look over of the configuration and some questions I have: Its a long post and I appreciate anyone taking time to read through it.
My goals are the following:
     to make the inside network 10.20.145.0 to allow internet access - as long as the connection starts inside
     To allow neighbor network that comes in through outside interface origin 170.20.0.0/16 access to the 10.20.145.0 (bidirectional)
     The tunnel from neighbor lan to inside lan happens through vpn concentrator that has external ip address and 77.76.19.35
     Allow certain devices on the DMZ to access the internet and allow outside to inside connections on certain ports
Much of the settings I have configured are coming from juniper that is currently online but needs to be replaced.
The network is set up as below for a chart of traffic:
ISP ---- Internet router ---- switch (3 active connections) 1. firewall 2. internet router   3. vpn concentrator
There is an internal 3750 that I have configured with ip 10.20.145.15 since it comes up often
I'm using pub IPs on the machines on the DMZ though I'm thinking of changing that to an internal vlan and than nating it out. Well here's what I have so far:
=================================================================================================
ASA Version 8.3(2)
hostname ASA
domain-name a.domain.com
enable password l4Tu/tqHeN0MdD7t encrypted
passwd dL9fmCBkHiwx4Iib encrypted
names
interface Management0/0
nameif management
security-level 100
ip address 192.168.1.1 255.255.255.0
management-only
interface GigabitEthernet1/0
description outside-interface-connected-to-internet-switch
speed 1000
duplex full
shutdown
nameif outside
security-level 0
ip address 76.77.19.34 255.255.255.240
interface GigabitEthernet1/1
description inside-int-10.20.145-network
speed 1000
duplex full
shutdown
nameif inside
security-level 100
ip address 10.20.145.3 255.255.255.192
interface GigabitEthernet1/2
shutdown
nameif DMZ
security-level 50
ip address 76.77.19.49 255.255.255.240
interface GigabitEthernet1/3
shutdown
no nameif
no security-level
no ip address
boot system disk0:/asa832-k8.bin
ftp mode passive
clock timezone EST -5
lock summer-time EDT recurring
dns domain-lookup outside
dns server-group DefaultDNS
name-server 76.77.6.11
name-server 66.72.76.84
name-server 4.2.2.1
name-server 8.8.8.8
domain-name a.domain.com
object network Inside_lan
subnet 10.20.145.0 255.255.255.0
object network NET-neighbor
subnet 170.20.0.0 255.255.0.0
description neighbor_LAN
object network 76.77.19.44_cake
host 76.77.19.44
description cake
object network 76.77.19.59
host 76.77.19.59
description streaming
object network 76.77.19.61
host 76.77.19.61
description streaming
object network cindy
host 50.56.249.224
description cindy
object-group network internal-LAN
network-object object Inside_lan
object-group service 3306 tcp
description 3306
port-object eq 3306
object-group service 4567 tcp
description 4567
port-object eq 4567
object-group icmp-type ICM
description ICM_basic
icmp-object echo
icmp-object echo-reply
icmp-object time-exceeded
icmp-object traceroute
icmp-object unreachable
object-group service Retriever_SVC tcp
description Retriever
port-object range 8000 8001
object-group service Production tcp
description PM
port-object range www www
object-group service RDP tcp
description RDP
port-object eq 3389
object-group service Streaming tcp
description streaming server
port-object eq 7009
object-group service UDP123 udp
description 123
port-object eq ntp
object-group service affordable tcp
description affordable legacy
port-object eq 85
object-group service market tcp
description ports for market dmz
port-object eq 2189
port-object eq 2190
port-object eq 2192
port-object eq 2194
object-group service messenger tcp
description air messenger
port-object eq 444
object-group service traffic-701 tcp
description 701
port-object eq 701
object-group service ntp1 udp
description ntp-udp-1
group-object UDP123
object-group service payroll tcp
description payroll port
port-object eq 714
object-group service snmp-udp udp
description snmp udp 1
port-object eq snmp
object-group service vitrol tcp
description vitrol custom
port-object eq 5986
object-group service webconferrence tcp
description webconference legacy port
port-object eq 1417
port-object eq 407
object-group service webmail tcp
description webmail ports
port-object eq 2095
object-group service INLINE_TCP_1 tcp
port-object eq ftp
port-object eq ftp-data
object-group service INLINE_SERVICE_1
service-object tcp
service-object icmp echo-reply
service-object icmp traceroute
service-object icmp unreachable
service-object tcp destination eq ftp
service-object tcp destination eq ftp-data
service-object tcp destination eq www
service-object tcp destination eq https
service-object udp destination eq echo
service-object udp destination eq ntp
service-object udp destination eq radius
service-object udp destination eq radius-acct
service-object udp destination eq syslog
object-group network INLINE_NETWORK_1
network-object host 76.57.19.53
network-object host 255.255.255.255
object-group service INLINE_TCP_2 tcp
group-object Streaming
group-object vitrol
object-group service INLINE_SERVICE_2
service-object ip
service-object tcp
service-object tcp destination eq ftp
service-object tcp destination eq ftp-data
service-object tcp destination eq www
service-object tcp destination eq https
service-object tcp destination eq ssh
access-list internet extended permit ip object Inside_lan interface outside
access-list internet extended permit object-group DM_INLINE_SERVICE_1 object Inside_lan any
access-list syndicaster extended permit tcp object Cindy object Inside_lan object-group INLINE_TCP_1
access-list streaming extended permit tcp interface DMZ any object-group Streaming
access-list streaming59 extended permit tcp object 76.77.19.59 interface outside object-group Streaming
access-list streaming_outside_in extended permit tcp interface outside object-group INLINE_NETWORK_1 object-group DM_INLINE_TCP_2
access-list neighbor extended permit object-group INLINE_SERVICE_2 object NET-neighbor object Inside_lan
pager lines 24
logging enable
logging asdm informational
mtu management 1500
mtu outside 1500
mtu inside 1500
mtu DMZ 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
nat (inside,outside) source dynamic any interface
object network Inside_lan
nat (any,outside) dynamic interface
access-group neighbor in interface outside
access-group neighbor out interface inside
route outside 0.0.0.0 0.0.0.0 76.77.19.33 1
route inside 10.0.0.0 255.255.255.0 10.20.145.4 1
route inside 10.0.1.0 255.255.255.0 10.20.145.2 1
route inside 10.20.145.0 255.255.255.0 10.20.145.15 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 192.168.1.0 255.255.255.0 management
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet 10.20.145.39 255.255.255.255 inside
telnet timeout 5
ssh 10.20.145.39 255.255.255.255 inside
ssh timeout 5
console timeout 0
dhcpd dns 76.77.6.11 64.22.16.84
dhcpd domain a domain
dhcpd option 6 ip 4.2.2.1
dhcpd address 192.168.1.2-192.168.1.254 management
dhcpd enable management
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
username joe password m6OO.pH/13qc7ypS encrypted privilege 15
username bob password N./x1Ut.gM.QGZLa encrypted privilege 15
username bill password uZjIWeHtovCOweHJ encrypted
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
inspect icmp
inspect icmp error
service-policy global_policy global
prompt hostname context
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email [email protected]
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:06eb82d8d8a3ae82352512cd707e7f4a
========================================================================================================================================================
access-list cached ACL log flows: total 0, denied 0 (deny-flow-max 4096)
            alert-interval 300
access-list internet; 14 elements; name hash: 0xb30cf7fe
access-list internet line 1 extended permit ip object Inside_lan interface outside 0xe073f975
access-list internet line 1 extended permit ip 10.20.1450 255.255.255.0 interface outside (hitcnt=0) 0xe073f975
access-list internet line 2 extended permit object-group INLINE_SERVICE_1 object Inside_lan any 0x2e33ca08
access-list internet line 2 extended permit tcp 10.20.145.0 255.255.255.0 any (hitcnt=0) 0xa576d14f
access-list internet line 2 extended permit icmp 10.20.145.0 255.255.255.0 any echo-reply (hitcnt=0) 0x15cccd5c
access-list internet line 2 extended permit icmp 10.20.145.0 255.255.255.0 any traceroute (hitcnt=0) 0x8aab2f53
access-list internet line 2 extended permit icmp 10.20.145.0 255.255.255.0 any unreachable (hitcnt=0) 0xe02606e1
access-list internet line 2 extended permit tcp 10.20.145.0 255.255.255.0 any eq ftp (hitcnt=0) 0x6d0043b6
access-list internet line 2 extended permit tcp 10.20.145.0 255.255.255.0 any eq ftp-data (hitcnt=0) 0xce904411
access-list internet line 2 extended permit tcp 10.20.145.0 255.255.255.0 any eq www (hitcnt=0) 0x1ddebc69
access-list internet line 2 extended permit tcp 10.20.145.0 255.255.255.0 any eq https (hitcnt=0) 0x1a3b15bc
access-list internet line 2 extended permit udp 10.20.145.0 255.255.255.0 any eq echo (hitcnt=0) 0xadc66030
access-list internet line 2 extended permit udp 10.20.145.0 255.255.255.0 any eq ntp (hitcnt=0) 0xa67a4406
access-list internet line 2 extended permit udp 10.20.145.0 255.255.255.0 any eq radius (hitcnt=0) 0x230419e6
access-list internet line 2 extended permit udp 10.20.145.0 255.255.255.0 any eq radius-acct (hitcnt=0) 0xa8ae0824
access-list internet line 2 extended permit udp 10.20.145.0 255.255.255.0 any eq syslog (hitcnt=0) 0x051c7ef5
access-list cindy; 2 elements; name hash: 0x807c55e5
access-list cindy line 1 extended permit tcp object cindy object Inside_lan object-group DM_INLINE_TCP_1 0xe35e702c
access-list cindy line 1 extended permit tcp host 50.56.249.224 10.20.145.0 255.255.255.0 eq ftp (hitcnt=0) 0x64b321cc
access-list cindy line 1 extended permit tcp host 50.56.249.224 10.20.145.0 255.255.255.0 eq ftp-data (hitcnt=0) 0x55109118
access-list streaming; 1 elements; name hash: 0xfd34cf16
access-list streaming line 1 extended permit tcp interface DMZ any object-group Streaming_custom 0x8b2e87d1
access-list streaming line 1 extended permit tcp interface DMZ any eq 7009 (hitcnt=0) 0xb13a2776
access-list streaming59; 1 elements; name hash: 0x959c1f3b
access-list streaming59 line 1 extended permit tcp object 76.77.19.59 interface outside object-group Streaming_custom 0xc173840d
access-list streaming59 line 1 extended permit tcp host 76.77.19.59 interface outside eq 7009 (hitcnt=0) 0x84cd9084
access-list streaming_outside_in; 4 elements; name hash: 0x3f86c9d4
access-list streaming_outside_in line 1 extended permit tcp interface outside object-group INLINE_NETWORK_1 object-group DM_INLINE_TCP_2
access-list streaming_outside_in line 1 extended permit tcp interface outside host 206.57.19.53 eq 7009 (hitcnt=0) 0x06c04720
access-list streaming_outside_in line 1 extended permit tcp interface outside host 206.57.19.53 eq 5986 (hitcnt=0) 0x9ae9047e
access-list streaming_outside_in line 1 extended permit tcp interface outside host 255.255.255.255 eq 7009 (hitcnt=0) 0x5e3553e8
access-list streaming_outside_in line 1 extended permit tcp interface outside host 255.255.255.255 eq 5986 (hitcnt=0) 0x1f5d8fd9
access-list neighbor; 7 elements; name hash: 0xc99eb2b4
access-list neighbor line 1 extended permit object-group INLINE_SERVICE_2 object NET-neighbor object Inside_lan 0xc9688a21
access-list neighbor line 1 extended permit ip 170.20.0.0 255.255.0.0 10.20.145.0 255.255.255.0 (hitcnt=0) 0xe1e8b995
access-list neighbor line 1 extended permit tcp 170.20.0.0 255.255.0.0 10.20.145.0 255.255.255.0 (hitcnt=0) 0x462beedc
access-list neighbor line 1 extended permit tcp 170.20.0.0 255.255.0.0 10.20.145.0 255.255.255.0 eq ftp (hitcnt=0) 0xf238c75e
access-list neighbor line 1 extended permit tcp 170.20.0.0 255.255.0.0 10.20.145.0 255.255.255.0 eq ftp-data (hitcnt=0) 0x266e675b
access-list neighbor line 1 extended permit tcp 170.20.0.0 255.255.0.0 10.20.145.0 255.255.255.0 eq www (hitcnt=0) 0x8627ec0a
access-list neighbor line 1 extended permit tcp 170.20.0.0 255.255.0.0 10.20.145.0 255.255.255.0 eq https (hitcnt=0) 0x3cae424a
access-list neighbor line 1 extended permit tcp 170.20.0.0 255.255.0.0 10.20.145.0 255.255.255.0 eq ssh (hitcnt=0) 0xcb6666b3

Hi,
For the Default Dynamic PAT rule that you are asking for the single "inside" network I would suggest the following
First remove the current NAT configurations
nat (inside,outside) source dynamic any interface
object network Inside_lan
nat (any,outside) dynamic interface
Then reconfigure the NAT in the following way
object-group network DEFAULT-PAT-SOURCE
network-object 10.20.145.0 255.255.255.0
nat (inside,outside) after-auto sourece dynamic DEFAULT-PAT-SOURCE interface
This will create and "object-group" for the networks or hosts that should be PATed to the "outside" interface IP address when accessing the Internet. If you want more internal networks to get PATed the same way, you simply add the network under the "object-group" among the already existing "inside" network.
The "after-auto" parameter also makes sure that this NAT rule doesnt override any other future rules. The parameter in question moves the NAT rule at the bottom of the NAT rules so its one of the last matched agains when traffic arrives on the firewall from behind "inside"
With regards to the neighbor network of 172.20.0.0/16, is this some network that is going to be behind a L2L VPN or is simply almost directly behind the "outside" interface?
In general the NAT format for this kind NAT is
object network NEIGHBOR
subnet 172.20.0.0 255.255.0.0
object-group network NEIGHBOR-SOURCE
network-object 10.20.145.0 255.255.255.0
nat (inside,outside) source static NEIGHBOR-SOURCE NEIGHBOR-SOURCE destination static NEIGHBOR NEIGHBOR
I basically use an "object network" to define the remote network and "object-group network" to define the source network for this NAT. I use "object-group" for the source again because it leaves us room to add more networks under it if needed. Notice that "object network" can only hold one subnet/range/host while "object-group network" can hold pretty much as many as you want.
I think the ACL configurations will have to be looked through also.
Notice that if you want to control traffic from a behind "outside" for example, then you can only use 1 interface bound ACL to control that traffic. So every rule from "outside" to "inside" or to "dmz" has to be in the same ACL. Also this ACL would be attached to the "outside" interface in "in" direction. For example "access-group OUTSIDE-IN in interface outside"
If we are talking about VPN connections configured directly to the ASA there are some other options compared to the above.
But as I said its better that your needs regards the ACL rules are gone through more in depth to really know how we should configure them as I am myself not sure what all the above ACL are supposed to do.
One final question for you. You have this network directly on the "inside" interface 10.20.145.3 255.255.255.192. But you also talk about it with mask /24. Is the ASA "inside" connected to some internal L3 device which hosts rest of the segments of this whole /24 network as currently the "inside" interface holds /26.
Is ANY users/networks behind the ASA "inside" interface using the ASA directly as their gateway? I noticed that you setup would seem to have (as I mentioned in another thread to you) several devices on connected by the same LAN network (Router,VPN,firewall). What I fear will happen is that IF any "inside" users uses the ASA as their gateway and has to be routed back through the ASA "inside" interface to some other gateway that this will result in asymmetric routing and the ASA doesnt really handle that kind of situation that well.
- Jouni

SLM2024 ACL configuration

I have a question on how to setup an ACL configuration on the SLM2024. I originally got this switch to just be able to monitor network ups/downs on the ports. and this has worked great in diagnosing the problems I was having originally. Now however I have to setup something on here that I have never had to do, and am unsure how to do it.
I have a computer that sends out a UDP broadcast that is causing our Xerox Phaser network printer to shutdown if it sees the broadcast. The Phaser is designed in a way that if it sees something on the network it thinks is harmful it will shut itself off to protect itself. and on startup if it sees something harmful it will not startup, it will go into an infinite restart loop.
After fully testing everything I can think of I got it down to a piece of software on the computer that sends the UDP broadcast. If this software is not running the printer works fine. Unfortunately the software needs to run 24/7, and we need to print.
Both the computer and printer have static ip addresses. and basically all I want to do is setup an ACL (at least thats what others have told me) to block communication between those two ip addresses so that the printer won't see the UDP broadcast anymore.
So my question is, would an ACL block that traffic? and if so how do I set it up? I looked in the manuals that came with the switch, and i'm not really seeing any information on how to do it. If anyone can give me some insight into what I need to do I would greatly appreciate it.
Thanks

I have a question on how to setup an ACL configuration on the SLM2024. I originally got this switch to just be able to monitor network ups/downs on the ports. and this has worked great in diagnosing the problems I was having originally. Now however I have to setup something on here that I have never had to do, and am unsure how to do it.
I have a computer that sends out a UDP broadcast that is causing our Xerox Phaser network printer to shutdown if it sees the broadcast. The Phaser is designed in a way that if it sees something on the network it thinks is harmful it will shut itself off to protect itself. and on startup if it sees something harmful it will not startup, it will go into an infinite restart loop.
After fully testing everything I can think of I got it down to a piece of software on the computer that sends the UDP broadcast. If this software is not running the printer works fine. Unfortunately the software needs to run 24/7, and we need to print.
Both the computer and printer have static ip addresses. and basically all I want to do is setup an ACL (at least thats what others have told me) to block communication between those two ip addresses so that the printer won't see the UDP broadcast anymore.
So my question is, would an ACL block that traffic? and if so how do I set it up? I looked in the manuals that came with the switch, and i'm not really seeing any information on how to do it. If anyone can give me some insight into what I need to do I would greatly appreciate it.
Thanks

4500 IOS-XE: Crash on ACL configuration

Hi All ,
We have recently migrated from standalone to VSS on our C4500 switches with Sup 7-E.
but the switch crashes every time we edit or modify the ACL with below error message :
%SYS-3-BADBLOCK: Bad block pointer
%SYS-6-MTRACE: mallocfree: addr, pc
%SYS-6-BLKINFO: Corrupted next pointer blk
%SYS-6-MEMDUMP: 0x7E043FF8
We noticed that there is a new bug for this issue i.e
CSCun33897 Symptom:
A Catalyst 4500 series switch running IOS-XE may unexpectedly reboot when ACL configuration is applied to an interface.
but there is no fix available yet.
Please let me know if anyone had this kind of issue. Appreciate your suggestion and feedback on this issue .
Current used Image : cat4500e-universalk9.SPA.03.05.00.E.152-1.E.bin .
Thanks in advance .

its seems to be closely matching to the bug you mentioned
If you upload crashinfo i can look it and try to confirm.
Regards
Naveen
***rate if it is helpful***

The question about vlan,acl of SWR224P

i find a strange thing.when i configure vlan,i find i can not write the english word in the "VLAN Name "
if i do,when i reboot this machine,the configration about vlan will bo lost??????????so,is there anybody can tell
me why.....
another problem,when i configure the ip acl,for example, Source IP Address1.1.0.0 Wildcard Mask0.0.7.255
destination any ,protocal any
but it tell me the date is wrong.so is the format i configure wrong.
thank you........body

hi,
I also tried to configure VLAN for my switch, you may check on this link on how to create VLAN. This link is for SRW224G4P but it might work on your SRW224P
http://kb.linksys.com/16824;
Another thing to consider is the fimware of your switch, check the version of the firmware and if it's a lower version you may update it.
Regarding your second inquiry about ACL, you may try to reconfiguring your ACL again once you updated the firmware.

Clearing an Dynamic Cluster -HSRP and Dynamic Cluster -NAT ACL configuration

I am trying to upgrade a 2950-24 Catalyst Switch that wa previously configured with both Dynamic HSRP and NAT ACL as shown in the following extract below.
I would like to remove this configuration but it is proving so difficult, this is because, I dont understand how the configuration got here in the first place, please help
=========================================================
SW1#show access-list
Extended IP access list CMP-NAT-ACL
    Dynamic Cluster-HSRP deny   ip any any
    Dynamic Cluster-NAT permit ip any any
=========================================================
interface Vlan1
ip address 192.168.87.2 255.255.255.0
no ip route-cache
ip http server
ip access-list extended CMP-NAT-ACL
dynamic Cluster-HSRP deny   ip any any
dynamic Cluster-NAT permit ip any any
line con 0
exec-timeout 0 0
line vty 0 4

I am trying to upgrade a 2950-24 Catalyst Switch that wa previously configured with both Dynamic HSRP and NAT ACL as shown in the following extract below.
I would like to remove this configuration but it is proving so difficult, this is because, I dont understand how the configuration got here in the first place, please help
=========================================================
SW1#show access-list
Extended IP access list CMP-NAT-ACL
    Dynamic Cluster-HSRP deny   ip any any
    Dynamic Cluster-NAT permit ip any any
=========================================================
interface Vlan1
ip address 192.168.87.2 255.255.255.0
no ip route-cache
ip http server
ip access-list extended CMP-NAT-ACL
dynamic Cluster-HSRP deny   ip any any
dynamic Cluster-NAT permit ip any any
line con 0
exec-timeout 0 0
line vty 0 4

Extended ACL configuration

Hello everyone,
I use ACLs on a daily basis and every now and then I need to insert a remark above a particulare line.
As of today I do the following:
Step 1: Creating a temp. copy of the desired ACL and bind it to the Interface to ensure functionality while editing the original ACL
Step 2: Delete the original ACL and then recreate it with the added line(s)
Step 3: Bind the newly created ACL to the Interface, delete the temp. created ACL
Is there a way similar to include new lines by useing the sequence numbers to insert a remark above a specific line?
thanks in advance
Marcel

Hi Marcel
you didn't mentioning about what kind of device (model, firmware/ios version) you are writing.
ACL's can be done on variety of devices with very different forms of configuration, moreover you are writing inside Small Business section of this forum (related to specified group devices without using IOS software).

PI7.0: Problem about openning alert configuration in RMB

Hi experts,
   I encounter a problem about alert configuration.
   I have defined the alert catogory in WAS ABAP and use the report RSALERTTEST to test it. It's OK. Then I logon RWB and click u201CAlert configurationu201D,system popup a login window. I input my user account and confirm it. But the logon window popup again and again.I don't kown how to resolve it. BTW, my user account has the roles SAP_ALM_ADMINISTRATOR and SAP_ALM_CUSTOMIZER.And I have resolved the problem "Alert configuration does not start" according to note 750287.
   Anyone has idea??Could you please give me some advice???
Thanks a lot in advance.
BR Villy.L

Hello Villy
Check these notes:
1) #913858 XI Alerting: Troubleshooting
2) #768456 Troubleshooting Runtime Workbench
Restart the java engine after making any changes in the Exchange Profile.
For further info check previous threads on this topic:
The URL contains no complete domain specification
Calling the BSP page terminated due to an error While accessing ALERT INBOX
Regards
Mark

PI7.0: Problem about openning alert configuration in RWB

Hi experts,
   I encounter a problem about alert configuration.
   I have defined the alert catogory in WAS ABAP and use the report RSALERTTEST to test it. It's OK. Then I logon RWB and click u201CAlert configurationu201D,system popup a login window. I input my user account and confirm it. But the logon window popup again and again.I don't kown how to resolve it. BTW, my user account has the roles SAP_ALM_ADMINISTRATOR and SAP_ALM_CUSTOMIZER.And I have resolved the problem "Alert configuration does not start" according to note 750287.
   Anyone has idea??Could you please give me some advice???
Thanks a lot in advance.
BR Villy.L

Hi Villy,
Although i have not faced this issue but one workaround fix that can help you to address your problem would be....
Please add below 'actions' to 'everyone' role using NWA->Identity Management
UME keystore-view.TicketKeystore entry-actions.all.all
UME keystore-view.TicketKeystore property-actions.all.all
UME keystore-view.TicketKeystore view-actions.all.all
Then, Initiate RWB using URL - http://<j2ee-host>:<http-port>/rwb/rtc?op=init
I hope this fixes your issue.
Regards
Sekhar

Advice about FXS Port configuration for connecting to modems

Hello all,
We have not confirm the problem, but we are having reports that analog devices like USR V.92 Modems and Power meters are not connecting or dropping the connection. We have an ISR 2911 with the 4-port FXS-DID WIC (VIC3-4FXS/DID), configure to an internet SIP truck provider. The Router is running IOS 15.3(3)M2. If we connect an analog phone to the FXS port and call, voice is clear. So the question is what configuration settings should we have for FXS ports and/or dialpeers for connections to modems? Attached is the current configuration of the router.
Do we have to be worried about Codec? If so which Codec should we configure?
Any Physical FXS settings should be set?
Are my DSP setup correctly?
Again, I'm at a loss, as voice sounds good and my searches for modem connections to FXS Ports on CUCME is coming up dry. Any help would be great.
As far as the "Power Meters", we are talking substation power meters.
Thanks for any advice you can spare and your time,
Nick

Hi Amit,
No problem on the delay. Your help is very much appreciated.
You're losing me a bit. Because I don't know if your giving me dial-peer 1 as an example. 1 being just a random number. Or your telling me to change my current dial-peer 1 configuration. Which is currently a pots dial-peer:
dial-peer voice 1 pots
description POTS port 0/1/0
destination-pattern 111111111
port 0/1/0
dial-peer 1000 voip is our outbound call leg. Sorry call legs are not exactly clear to me yet. In fact they haven't been in years. :) So change my dial-peer to dial-peer voice 1 voip?
My other question still unknown to me is should we use:
fax protocol pass-through g711ulaw
Even though we are trying to use a modem and not a fax? Also this command is a dial-peer command and not a global command. So what global command should i be using?
Again thank you for your time and help,
Nick

Support validity question about installing and configuring SP13 on same machine as FAST to use both as search engines for SP2010

Hi,
I have a SharePoint 2010 farm which is using its own servers.
This farm has a FAST Search for SharePoint server which is a standalone on a dedicated server.
This farm is my testing staging environment and not a Production environment, eventhough its almost an exact copy of the Production farm.
I would like to replace the FAST server with SharePoint 2013 as a search engine for my SharePoint 2010 farm.
Because i have a standalone deployment of FAST on a dedicated server and i dont have any more servers to add to this farm,
I would like to install SharePoint 2013 on same server as FAST while FAST is still active, connect it to the 2010 farm and do some tests before i will remove the FAST content and query SSA's.
I would like to know if installing a SP2013 on same machine as FAST is supported by Microsoft as long as the FAST is not connected to the SP2013? (performance is not an issue)
What about All in one machines like development servers, is it supported by Microsoft to install FAST on same machine as SP2010 farm? (again, performance is not an issue)
thanks,
Guy

I would like to know if this scenario is supported by microsoft.
This installation will be for testing purposes only, if there are any issues with installing SharePoint2013 on a FAST search machine, i would like to know what kind of problems i may run into.
I'd also like to clear out that this FAST and SharePoint2013 are not comunicating with eachother but with a SharePoint2010 farm that is configured on different servers.
I would really appreciate direct answers to these questions.
thanks for your answers,
Guy

A question about Kintex-7 configuration

Hi
I want to design a custom board with Kintex-7 FPGA(XC7K160T). I have a question about it's config. Can i use XCF128XFTG64 for this FPGA? If not, can you tell me what kind of Flash I can use?

Platform flash not supported in 7-series FPGA. Refer http://www.xilinx.com/support/answers/46093.html for details
As per "Table 1-1: Bitstream Length (Page-14) in configuration user guide (http://www.xilinx.com/support/documentation/user_guides/ug470_7Series_Config.pdf) the required bit stream length for XC7K160T device is 53,540,576 bits. By considering overheads the required size of flash is 64 Megabits or larger.
What version of tools are you using? What type of configuration mode are you planning? Refer “Configuration overview” topic (Page -11 onwards ) in http://www.xilinx.com/support/documentation/user_guides/ug470_7Series_Config.pdf to know different types of supported configuration modes.
You need to use CPLD/Microprocessor for slave Selectmap kind of configuration.
Impact tools(In case of using ISE tools) help topics list the supported BPI/SPI flash details in case of planning SPI/BPI kind of configuration modes.

Please send about the variant configuration

Hi
please send about the variant configuration

Steps for SD Variant Configuration
Some light on Variant Configuration in Detail.
The procedure is as follows:
Create a Material - KMAT type with Item category (002)
Create Charateristics in CT04 - Zbike, where in values mention the Color of the bile like Red, Blue etc
Create another characteristics in CT04 - ZPrice, where directly go the additional data tab and maintain the table SDCOM and field VKOND (ABAP Dictionary it will ask for)
Assign these two characteristics to a Class in CL01 - ZBikeclass ( Type 300) in characteristics tab page.
Then go to CU41 Configuration profile select the material and enter the description click on the class assignment ie assign Zbikclass.
Now go back to CT04 - enter Zbike -go to values- select Red- go to extras - Other Dependencies - Select Procedure enter in front 10 write - $self.ZPrice='Red' and save
Now go back go to extras - Other Dependencies - assignments and assign relationship ( by default it will come just save)
Now select Blue- go to extras - Other Dependencies - Editor - Select Procedure enter in front of 10 write - $self.ZPrice='Blue' and save
Now go back go to extras - Other Dependencies - assignments and assign relationship ( by default it will come just save)
Now go to VK11 - Enter VA00 (Condition)(For Std RVA001 Pricing Procedure) - enter variant Red and Blue give the rates accordingly and create the sales order.

Question about RADIUS server configuration with a MacBook Pro

Hello,
I own a modem router which is capable of WPA2 Enterprise and I want to use it with a RADIUS server for authentication and security purposes.
However, I have a few doubts about this.
MY CONFIGURATION:
The modem router would be connected to a fixed PC with Windows and to a MacBook Pro (both with Ethernet)
The RADIUS server would be running on the MacBook Pro (freeRADIUS)
The bold is the issue, that comes when I disconnect the MBP (it's a notebook, so I use it disconnected from the router sometimes).
Supposing the router would have recognized it (correct configuration), it would disconnect from it.
My questions:
Would Wi-Fi be lost in this manner? Or would the modem router automatically switch to another Wi-Fi authentication?
If I reconnected the MBP to the modem router and re-run the RADIUS server, would I need to access the control panel and re-configure the WPA2 Enterprise in order for Wi-Fi to work again?
Thanks in advance,
Tyrexionibus

"Full HD 3DD camcorder..." Marketing at it's best.
This is HDV, right? HDV has the same data rate as DV...13.6GB/hour. But because of the MPEG-2 Long GOP format the HDV format employs, it can be a bit tough to edit, but mainly when rendering effects. IT will be slower than DV, and you can't monitor thru the camera like you can with DV, but a simple FW400 drive and Intel Mac will be fine. Better if you can convert to ProRes upon ingest, but then that eats up a LOT more space and requires at least FW800...
http://library.creativecow.net/articles/poisson_chris/hdv-prores.php
Shane

About 2950 acl configuration

Similar Messages

Maybe you are looking for