Bandwidth percent - ios xr

hi everyone,
in a policy map - when you configure your classes - ex
class 1
bandwidth percent 25
class 2
bandwidth percent 25
class 3
bandwidth percent 25
class 4
bandwidth percent 25
- will this negate p2mdrr or mddr? ie. have I configured the policy to "not" have any remaining available bandwidth to any other classes?
thanks,
Andrew

hi andrew,
bw percent gives you a defined assigned CIR based on the parent shaping bandwidth.
bandwidth remaining (percent) will get a modified deficted  rate of the left over bandwidth after all the classes have been served that have an assigned CIR.
you can see how the programming of the shaped classes has been done with the command show qos int <interface> <direction> which gives you the CIR that is currently running on that class and their (excess) weight ratio as determined by the scheduler, available bw and all that.
cheers
xander

Similar Messages

  • ASR9K: bandwidth and bandwidth remaining cannot be used together. How to solve the problem to grant a quota and equally assign the remaining quota?

    Hi everyone
    The problem should be trivial. We want to grant a quota to specific classes and use equally the remaining quota of available bandwidth to all the requesting classes. Let's clarify with an example:
    Class 7 ==> priority queue, level 1 with police 20%
    Class 5 ==> priority queue, level 2 with police 40%
    Class 6 ==> CIR 12%
    Class 3 ==> CIR 11%
    Class 2 ==> CIR 8%
    Class 1 ==> CIR 5%
    Class 0 ==> CIR 4%
    To simplify let's suppose that there is no traffic on class 7 and 5 and that all remaining classes are generating traffic at a rate of 300Mbps each. Outgoing interface is 1G so congestion occurs. We want that each class 6,3,2,1,0 receive its granted value (so, respectively, 120M, 110M, 80M, 50M and 40M for a total of 400M) and that the remaining available bandwidth (600M) will be equally assigned, so 120M to each class.
    Documentation from IOS-XR 5.2.2 let's understand that this should be the default behavior but if we run the policy shown below what we get is a weighted assignment of the remaining quota.
    The policy used is the following:
    policy-map TEST-POLICY
     class qos7
      police rate percent 20
      priority level 1
     class qos5
      police rate percent 40
      priority level 2
     class qos6
      bandwidth percent 12
     class qos3
      bandwidth percent 11
     class qos2
      bandwidth percent 8
     class qos1
      bandwidth percent 5
     class qos0
      bandwidth percent 4
     class class-default
     end-policy-map
    The documentation of IOS-XR 5.2.2 states that both "bandwidth percent" and "bandwidth remaining percent" could be used in the same class (which could be a solution to force the requested behavior) but using both generates the following error:
    !!% Both bandwidth and bandwidth-remaining actions cannot be configured together in leaf-level of the queuing hierarchy: InPlace Modify Error: Policy TEST-POLICY: 'qos-ea' detected the 'warning' condition 'Both bandwidth and bandwidth-remaining actions cannot be configured together in leaf-level of the queuing hierarchy'
    How could be solved the problem? Maybe a hierarchical QoS with the granted quota in the parent policy and a "bandwidth remaining percent 20" in the child?

    Hi everyone
    just to provide my contribution, the hierarchical QoS policy works balancing the remaining bandwidth after granting the requested bandwidth (see the policy implemented below). However for priority queues it is granted the policer quota but sending more flows these appears to be unbalanced. So the problem to have both PQ served (in a balanced way between flows) AND have the remaining bandwidth distributed equally remains open ...
    policy-map TEST-POLICY-parent
     class qos6
      service-policy TEST-POLICY-child
      bandwidth percent 12
     class qos3
      service-policy TEST-POLICY-child
      bandwidth percent 11
     class qos2
      service-policy TEST-POLICY-child
      bandwidth percent 8
     class qos1
      service-policy TEST-POLICY-child
      bandwidth percent 5
     class qos0
      service-policy TEST-POLICY-child
      bandwidth percent 4
     class class-default
      service-policy TEST-POLICY-child
     end-policy-map
    policy-map TEST-POLICY-child
     class qos7
      police rate percent 20
      priority level 1
     class qos5
      police rate percent 40
      priority level 2
     class qos6
      bandwidth remaining percent 20
     class qos3
      bandwidth remaining percent 20
     class qos2
      bandwidth remaining percent 20
     class qos1
      bandwidth remaining percent 20
     class qos0
      bandwidth remaining percent 20
     class class-default
     end-policy-map

  • WRED+bandwidth allocation algorithm ?

    Dear Gurus!
    Plese tell me what is the bandwidth allocation algorithm:
    I have 3 flows within 1 class-map.
    WRED is enabled on the output ATM pvc(the total bandwidth of pvc is 2000kbps).
    Flows have dscp marks af11(10) af12(12) af13(14).
    When the pvc is congested the flows get the following bandwidth share in outgoing interface: af11(dscp 10) - 59% ; af12(dscp 12) - 40%; af13(dscp 14) - 1%; + bulk traffic with dscp 0.
    Total bandwidth allocated for flows 10,12,14 is near 1500000bits per sec (75% of 2000kbps)
    All flows have same packet sizes - 1400 bytes
    Plese tell me how 7200 calculates bandwidth allocation between flow with dscp 10 , 12 and 14.
    I have the following
    router 7206
    IOS (tm) 7200 Software (C7200-JK8S-M), Version 12.2(13), RELEASE SOFTWARE (fc1)
    cisco 7206VXR (NSE-1) processor (revision A)
    ATM PA - OC3
    config:
    class-map match-all af11
    match ip dscp af11 af12 af13
    policy-map gold
    class af11
    bandwidth percent 65
    random-detect dscp-based
    random-detect dscp 10 28 45 10
    random-detect dscp 12 28 43 10
    random-detect dscp 14 28 40 10
    class class-default
    bandwidth percent 10
    interface ATM2/0.34 point-to-point
    description RBNet
    bandwidth 2000
    ip address 10.0.4.1 255.255.255.252
    pvc rbnet 15/64
    vbr-nrt 2000 1500 50
    tx-ring-limit 3
    encapsulation aal5mux ip
    service-policy output gold
    Thanks in advance, Andrei

    Ok Andrei,
    Here's my thinking about what is happening...
    You are transmitting a total of 300*1400*8 = 3.36Mbps into a circuit that is configured for 2Mbps. Since this traffic is being sent at a continuous rate, that means that the queue is in a state of constant congestion. In fact, the size of the queue is going to be sitting around the maximum of 45 packets pretty much all the time. The only time that space is created in the queue is when:
    1. A packet is scheduled out of the queue
    2. Packets are dropped due to RED
    Now, if the queue is always around the 45 packet mark, that means that once the queue reaches that point, all packets for DSCP 14 are going to be dropped since the queue depth is greater than the maximum threshold of 40 for DSCP 14.
    Considering the DSCP 10 traffic now...Both the DSCP 10 and DSCP 12 traffic is operating in the RED drop zone since the queue size is much higher than their minimum threshold of 20. Therefore, roughly 1/10 packets are getting dropped for each of these flows. 1/10 of each flow would give you roughly 2 packets of each based on the fact that very little of the DSCP 14 traffic is getting through. Every time RED drops these packets, space is created in the queue and if at that point, the queue size is less than 43, packets for DSCP 12 are accepted. The queue size is always going to be less than or equal to 45, so slightly more of the DSCP 10 packets are accepted.
    I hope that explains the behaviour adequately.
    Pls do remember to rate posts.
    Paresh

  • IOS XR deny ace not supported in access list

    Hi everybody,
    We´ve a 10G interface, this is a MPLS trunk between one ASR 9010 and a 7613, and the first thing that we do is through a policy-map TK-MPLS_TG we make a shape of 2G to the interface to the output:
    interface TenGigE0/3/0/0
     cdp
     mtu 1568
     service-policy output TK-MPLS_TG
     ipv4 address 172.16.19.134 255.255.255.252
     mpls
      mtu 1568
    policy-map TK-MPLS_TG
    class class-default
      service-policy TK-MPLS_EDGE-WAN
      shape average 2000000000 bps
      bandwidth 2000000 kbps
    and we´ve the policy TK-MPLS_EDGE-WAN as a service-policy inside, this new policy  help us to asign bandwidth percent to 5 class-map, wich in turn match with experimental values classified when they got in to the router:
    class-map match-any W_RTP
     match mpls experimental topmost 5
     match dscp ef
     end-class-map
    class-map match-any W_EMAIL
     match mpls experimental topmost 1
     match dscp cs1
     end-class-map
    class-map match-any W_VIDEO
     match mpls experimental topmost 4 3
     match dscp cs3 cs4
     end-class-map
    class-map match-any W_DATOS-CR
     match mpls experimental topmost 2
     match dscp cs2
     end-class-map
    class-map match-any W_AVAIL
     match mpls experimental topmost 0
     match dscp default
     end-class-map
    policy-map TK-MPLS_EDGE-WAN
    class W_RTP
      bandwidth percent 5
    class W_VIDEO
      bandwidth percent 5
    class W_DATOS-CR
      bandwidth percent 30
    class W_EMAIL
      bandwidth percent 15
    class W_AVAIL
      bandwidth percent 2
    class class-default
    end-policy-map
    what we want to do is to assign a especific bandwidth to the proxy to the output using the class W_AVAIL, the proxy is 150.2.1.100. We´ve an additional requirement, wich is not apply this "rate" to some networks we are going to list only 4 in the example, so what we did was a new policy-map with a new class-map and a new ACL :
    ipv4 access-list PROXY-GIT-MEX
    10 deny ipv4 host 150.2.1.100 10.15.142.0 0.0.0.255
    20 deny ipv4 host 150.2.1.100 10.15.244.0 0.0.0.255
    30 deny ipv4 host 150.2.1.100 10.18.52.0 0.0.0.127
    40 deny ipv4 host 150.2.1.100 10.16.4.0 0.0.0.255
    50 permit tcp host 150.2.1.100 any
    60 permit tcp host 10.15.221.100 any
    policy-map EDGE-MEX3-PXY
     class C_PXY-GIT-MEX3
      police rate 300 mbps
     class class-default
     end-policy-map
    class-map match-any C_PXY-GIT-MEX3
     match access-group ipv4 PROXY-GIT-MEX
     end-class-map
    we asign a policy rate of 300 mbps to the class inside the policy EDGE-MEX3-PXY and finally we put this new policy inside the class W_AVAIL of the policy TK-MPLS_EDGE-WAN
    policy-map TK-MPLS_EDGE-WAN
    class W_RTP
      bandwidth percent 5
    class W_VIDEO
      bandwidth percent 5
    class W_DATOS-CR
      bandwidth percent 30
    class W_EMAIL
      bandwidth percent 15
    class W_AVAIL
      service-policy EDGE-MEX3-PXY
    class class-default
    end-policy-map
    and we get this:
    Wed Sep 17 18:35:36.537 UTC
    % Failed to commit one or more configuration items during a pseudo-atomic operation. All changes made have been reverted. Please issue 'show configuration failed' from this session to view the errors
    RP/0/RSP1/CPU0:ED_MEX_1(config-pmap-c)#show configuration failed
    Wed Sep 17 18:35:49.662 UTC
    !! SEMANTIC ERRORS: This configuration was rejected by
    !! the system due to semantic errors. The individual
    !! errors with each failed configuration command can be
    !! found below.
    !!% Deny ace not supported in access-list: InPlace Modify Error: Policy TK-MPLS_TG: 'km' detected the 'warning' condition 'Deny ace not supported in access-list'
    end
    Any  kind of help is very appreciated.

    That is correct, due to the way the class-matching is implemented in the TCAM, only permit statements in an ACL can be used for QOS class-matching based on ACL.
    unfortunately, you'll need to redefine the policy class match in such a way that it takes the permit only.
    if you have some traffic that you want to exclude you could do something like this:
    access-list PERMIT-ME
    1 permit
    2 permit
    3 permit
    access-list DENY-me
    !the exclude list
    1 permit
    2 permit
    3 permit
    policy-map X
    class DENY-ME
    <dont do anything> or set something rogue (like qos-group)
    class PERMIT-ME
    do here what you wanted to do as earlier.
    eventhough the permit and deny may be overlapping in terms of match.
    only the first class is matched here, DENY-ME.
    cheers!
    xander

  • XR - IOS QOS issue.

    Hello Masters ,
      While trying  to configure QOS in ASR 9001 , I am getting the below error . Kindly help me to find a solution for it.
    interface GigabitEthernet0/0/1/3.824897
     service-policy output ######PARENT-256K
    !!% 'qos-ea' detected the 'warning' condition 'Minimum value for bandwidth configuration is 64 kbps'
    Thanking You,
    Ram.

    Hello Xander ,
    I have pasted the template config QOS , which i have tried to config on ASR 9K.Is there any other ways to implement the same ?. Thanks in advance.
    class-map match-all XYZ-GOLD
     match dscp af41
    class-map match-all XYZ-SILVER
     match dscp af31
    class-map match-all XYZ-BRONZE
     match precedence 0
    policy-map XYZ-CHILD
     class XYZ-GOLD
      bandwidth percent 20
     class XYZ-SILVER
      bandwidth percent 60
     class XYZ-BRONZE
      bandwidth percent 20
    policy-map XYZ-PARENT-128K
     class class-default
      shape average 128000
      service-policy XYZ-CHILD
    Regards,
    Ram

  • QoS Priority Percent

    Hi All, 
    We are trying to create 3 QoS queues for a WAN circuit between a managed CE and the PE in our network. 
    Currently we have:
    policy-map PM_WAN_OUT
    class CM_VOICE
    priority percent 30
    set ip dscp ef
    class CM_CRITICAL
    bandwidth percent 30
    set ip dscp af31
    class class-default
    bandwidth percent 40
    set ip dscp 0
    random-detect dscp-based
    With the idea that VOIP and signalling has a LLQ of 30%, critical data has 30% and everything else has 40%.
    We've done a little testing and can see that the LLQ gets 30% of the bandwidth, however, if there is no traffic in the LLQ, will the other queues be able to use that bandwidth? For example, if there were no voice calls, or critical data (queues 1 and 2) then the default class could have 100% of the bandwidth? 
    Also, is it best practice to map DSCP to EXP for transmission over our MPLS network, or use mls qos trust dscp instead?
    Thanks for the help

    Disclaimer
    The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.
    Liability Disclaimer
    In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.
    Posting
    In answer to your first question, normally, "unused" class bandwidth is available to other classes.  So, yes, also normally, the default class might use 100% of the bandwidth (if none is being used by other classes).

  • Bandwidth Restriction

    Hi,
    i have got internet router cisco 1700 series, my fastethernet has got 1 public IP address eg. 10.10.10.1 connected to LAN& S0/0 as got public IP address eg. 1.1.1.1 which is connected to ISP(1 Mbps lease line). i have been using few public IP address to my LAN for FTP,Webserver,Mail Server etc... now is there any option in the router where i can restrict only 128 Kbps alone for my FTP server. where FTP server IP is 10.10.10.2, since FTP alone is occupying almost entire bandwidth, users on my LAN trying to access internet is become very very slow.

    Hello,
    unfortunately the config above will not work, because it does not describe FTP traffic properly.
    TCP port 21 is only the control session, whereas the data transfer with active FTP is done through TCP port 20. Data transfer in general will cause your congestion problems. With passive FTP you will have dynamically assigned port numbers and then an access-list is NOT able to grab the majority of FTP transfer at all.
    So you need to use NBAR for your case. The config would look like this:
    ip cef
    class-map match-all FTPserver
    match ip address 100
    match protocol ftp
    policy-map Output1
    class FTPserver
    shape average 128000
    interface Serial0
    description 1Mbps to ISP
    ip address 1.1.1.1 255.255.255.252
    bandwidth 1024
    service-policy output Output1
    access-list 100 permit host 10.10.10.2 any
    The class-map FTP describes traffic, which is from host 10.10.10.2 AND is FTP. This includes active and passive FTP control session and data session.
    In the policy this traffic is limited to 128 kbps through shaping, i.e. there is never more than 128 kbps utilization from FTP traffic on your WAN link.
    In case you would like to limit FTP only in case there is other traffic please use the following policy:
    class-map match-all FTPserver
    match ip address 100
    match protocol ftp
    class-map match-all NonFTPserver
    match not class FTPserver
    policy-map Output1
    class NonFTPserver
    bandwidth percent 75%
    This will guarantee 75% of the bandwidth to traffic not being FTP from your server. This will only restrict FTP traffic when thre is no other traffic.
    Cisco does recommend not to plan for more than 75% percent of interface bandwidth, because of L2 keepalives, and system messages in general.
    Hope this helps! Please rate all posts.
    Regards, Martin

  • Bandwidth available when classifying

    I'm having trouble with my queuing config and was hoping that someone could take a look please? I have created the following:
    class-map match-any critical
    match protocol rtp
    class-map match-any priority
    match access-group 180
    policy-map queue
    class critical
    priority percent 35
    class priority
    bandwidth percent 40
    class class-default
    fair-queue
    random-detect dscp-based
    And then:
    int s0/0/0:0
    service-policy output queue
    Then when I do a show int, the available bandwidth goes to 1kpbs (formerly 1536kbps)
    Output queue: 0/1000/64/916 (size/max total/threshold/drops)
    Conversations 0/2/256 (active/max active/max total)
    Reserved Conversations 2/2 (allocated/max allocated)
    Available Bandwidth 1 kilobits/sec
    This is a 2mbps serial interface on a 2800 running Version 12.3(8r)T7.
    So, why would the available bandwidth become 1kpbs? Is available bandwidth referring to the bandwidth that's left for the class-default? Or the bandwidth availble to the critical & priority class?
    I should also mention that it wouldn't allow me to increase the priority bandwidth to above 35%. Also, bandwidth is configured as 2048 on the interface.
    Any help gratefully recieved!
    Thanks,
    J

    Hi Spremkumar,
    Thanks for your response. Here is the output. I have changed the values though to:
    class critical 20%
    class prioirty 30%
    It doesn't look like it's working though:
    show policy-map interface s0/0/0:0
    Serial0/0/0:0
    Service-policy output: queue
    Class-map: critical (match-any)
    0 packets, 0 bytes
    5 minute offered rate 0 bps, drop rate 0 bps
    Match: protocol rtp
    0 packets, 0 bytes
    5 minute rate 0 bps
    Queueing
    Strict Priority
    Output Queue: Conversation 264
    Bandwidth 20 (%)
    Bandwidth 409 (kbps) Burst 10225 (Bytes)
    (pkts matched/bytes matched) 0/0
    (total drops/bytes drops) 0/0
    Class-map: priority (match-any)
    0 packets, 0 bytes
    5 minute offered rate 0 bps, drop rate 0 bps
    Match: access-group 180
    0 packets, 0 bytes
    5 minute rate 0 bps
    Queueing
    Output Queue: Conversation 265
    Bandwidth 30 (%)
    Bandwidth 614 (kbps) Max Threshold 64 (packets)
    (pkts matched/bytes matched) 0/0
    (depth/total drops/no-buffer drops) 0/0/0
    Class-map: class-default (match-any)
    72727 packets, 38704060 bytes
    5 minute offered rate 769000 bps, drop rate 0 bps
    Match: any
    Queueing
    Flow Based Fair Queueing
    Maximum Number of Hashed Queues 256
    (total queued/total drops/no-buffer drops) 3/100/0
    exponential weight: 9
    dscp Transmitted Random drop Tail drop Minimum Maximum Mark
    pkts/bytes pkts/bytes pkts/bytes thresh thresh prob
    af11 0/0 0/0 0/0 32 40 1/10
    af12 0/0 0/0 0/0 28 40 1/10
    af13 0/0 0/0 0/0 24 40 1/10
    af21 0/0 0/0 0/0 32 40 1/10
    af22 0/0 0/0 0/0 28 40 1/10
    af23 0/0 0/0 0/0 24 40 1/10
    af31 0/0 0/0 0/0 32 40 1/10
    af32 0/0 0/0 0/0 28 40 1/10
    af33 0/0 0/0 0/0 24 40 1/10
    af41 0/0 0/0 0/0 32 40 1/10
    af42 0/0 0/0 0/0 28 40 1/10
    af43 0/0 0/0 0/0 24 40 1/10
    cs1 26/3166 0/0 0/0 22 40 1/10
    cs2 0/0 0/0 0/0 24 40 1/10
    cs3 0/0 0/0 0/0 26 40 1/10
    cs4 0/0 0/0 0/0 28 40 1/10
    cs5 0/0 0/0 0/0 30 40 1/10
    cs6 41/3928 0/0 0/0 32 40 1/10
    cs7 0/0 0/0 0/0 34 40 1/10
    ef 0/0 0/0 0/0 36 40 1/10
    rsvp 0/0 0/0 0/0 36 40 1/10
    default 72888/38781710 100/73423 0/0 20 40 1/10

  • Grant bandwidth (CBWFQ?)

    Hi Team,
    i am new to the community so i greet you all!
    My doubts and problems are related to the need to shape the traffic of a class granting a minimum bandwidth.
    We have a 7206-VXR so we have Gigabit physical interfaces, our SP is granting 200Mbps.
    The shape is working fine but the bandwidth command don't trigger couse, for my router, there's no congestion.
    I think that this is a common problema and maybe i am trying to solve in the wrong way.
    Any suggestion is appreciated
    Thanks in advance
    Denis

    Hi Denis,
    Shaping using the 'shape' cli defines the max rate for a class; whereas, the 'bandwidth' cli defines the minimum bandwidth guarantee for that class under functional congestion.
    For example,
    policy-map test
    class A
      shape average percent 20
    class B
       bandwidth percent 10
      class C
        bandwidth percent 30
    - Traffic through class A will *always* get shaped to 20% of intf bandwidth. Doesn't matter whether the interface is congested or not.
    - Traffic through class B and Class C will get a *minimum* guarantee of 10 and 30% of intf bandwidth when the interface is congested. When the interface is not congested, then there is really no need for a queueing policy (~ bandwidth cli) and the queueing part of the policy won't kick in. So, class B / class C can basically use the entire intf bandwidth if there is no traffic through the other (bandwidth) classes. However, should the physical interface be congested (tx_ring is full) then queueing kicks in and each class is given a minimum guarantee that's configured. The remaining bandwidth is shared amongst the bandwidth classes in the ratio of guarantees.
    - Abhi

  • VPN Clients cannot access remote site

    Hey there,
    I am pretty new in configuring Cisco devices and now I need some help.
    I have 2 site here:
    site A
    Cisco 891
    external IP: 195.xxx.yyy.zzz
    VPN Gateway for Remote users
    local IP: VLAN10 10.133.10.0 /23
    site B
    Cisco 891
    external IP: 62.xxx.yyy.zzz
    local IP VLAN10 10.133.34.0 /23
    Those two sites are linked together with a Site-to-Site VPN. Accessing files or ressources from one site to the other is working fine while connected to the local LAN.
    I configured VPN connection with Radius auth. VPN clients can connect to Site A, get an IP adress from VPN Pool (172.16.100.2-100) and can access files and servers on site A. But for some reason they cannot access ressources on site B. I already added the site B network to the ACL and when connecting with VPN it shows secured routes to 10.133.10.0 and 10.133.34.0 in the statistics. Same thing for other VPN Tunnels to ERP system.
    What is missing here to make it possible to reach remote sites when connected through VPN? I had a look at the logs but could not find anything important.
    Here is the config of site A
    Building configuration...
    Current configuration : 24257 bytes
    version 15.2
    no service pad
    service tcp-keepalives-in
    service tcp-keepalives-out
    service timestamps debug datetime msec localtime show-timezone
    service timestamps log datetime msec localtime show-timezone
    service password-encryption
    service sequence-numbers
    hostname Englerstrasse
    boot-start-marker
    boot config usbflash0:CVO-BOOT.CFG
    boot-end-marker
    aaa new-model
    aaa group server radius Radius-AD
    server 10.133.10.5 auth-port 1812 acct-port 1813
    aaa authentication login default local
    aaa authentication login ciscocp_vpn_xauth_ml_2 group Radius-AD local
    aaa authorization exec default local
    aaa authorization network ciscocp_vpn_group_ml_2 local
    aaa session-id common
    clock timezone Berlin 1 0
    clock summer-time Berlin date Mar 30 2003 2:00 Oct 26 2003 3:00
    crypto pki trustpoint TP-self-signed-27361994
    enrollment selfsigned
    subject-name cn=IOS-Self-Signed-Certificate-27361994
    revocation-check none
    rsakeypair TP-self-signed-27361994
    crypto pki trustpoint test_trustpoint_config_created_for_sdm
    subject-name [email protected]
    revocation-check crl
    crypto pki certificate chain TP-self-signed-27361994
    certificate self-signed 01
      30820227 30820190 A0030201 02020101 300D0609 2A864886 F70D0101 05050030
      2F312D30 2B060355 04031324 494F532D 53656C66 2D536967 6E65642D 43657274
      69666963 6174652D 32373336 31393934 301E170D 31323038 32373038 30343238
      5A170D32 30303130 31303030 3030305A 302F312D 302B0603 55040313 24494F53
      2D53656C 662D5369 676E6564 2D436572 74696669 63617465 2D323733 36313939
      3430819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281 8100B709
      64CE1874 BF812A9F 0B761522 892373B9 10F0BB52 6263DCDB F9877AA3 7BD34E53
      BCFDA45C 2A991777 4DDC7E6B 1FCEE36C B6E35679 C4A18771 9C0F871F 38310234
      2D89A4FF 37B616D8 362B3103 A8A319F2 10A72DC7 490A04AC 7955DF68 32EF9615
      9E1A3B31 2A1AB243 B3ED3E35 F4AAD029 CDB1F941 5E794300 5C5EF8AE 5C890203
      010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603 551D2304
      18301680 14D0F5E7 D3A9311D 1675AA8F 38F064FC 4D04465E F5301D06 03551D0E
      04160414 D0F5E7D3 A9311D16 75AA8F38 F064FC4D 04465EF5 300D0609 2A864886
      F70D0101 05050003 818100AB 2CD4363A E5ADBFB0 943A38CB AC820801 117B52CC
      20216093 79D1F777 2B3C0062 4301CF73 094B9CA5 805F585E 04CF3301 9B839DEB
      14A334A2 F5A5316F C65EEF21 0B0DF3B5 F4322440 F28B984B E769876D 6EF94895
      C3D5048A A4E2A180 12DF6652 176942F8 58187D7B D37B1F1A 4DDD7AE9 5189F9AF
      AF3EF676 26AD3F31 D368F5
          quit
    crypto pki certificate chain test_trustpoint_config_created_for_sdm
    no ip source-route
    ip auth-proxy max-login-attempts 5
    ip admission max-login-attempts 5
    no ip bootp server
    no ip domain lookup
    ip domain name yourdomain.com
    ip inspect log drop-pkt
    ip inspect name CCP_MEDIUM appfw CCP_MEDIUM
    ip inspect name CCP_MEDIUM ftp
    ip inspect name CCP_MEDIUM h323
    ip inspect name CCP_MEDIUM sip
    ip inspect name CCP_MEDIUM https
    ip inspect name CCP_MEDIUM icmp
    ip inspect name CCP_MEDIUM netshow
    ip inspect name CCP_MEDIUM rcmd
    ip inspect name CCP_MEDIUM realaudio
    ip inspect name CCP_MEDIUM rtsp
    ip inspect name CCP_MEDIUM sqlnet
    ip inspect name CCP_MEDIUM streamworks
    ip inspect name CCP_MEDIUM tftp
    ip inspect name CCP_MEDIUM udp
    ip inspect name CCP_MEDIUM vdolive
    ip inspect name CCP_MEDIUM imap reset
    ip inspect name CCP_MEDIUM smtp
    ip cef
    no ipv6 cef
    appfw policy-name CCP_MEDIUM
      application im aol
        service default action allow alarm
        service text-chat action allow alarm
        server permit name login.oscar.aol.com
        server permit name toc.oscar.aol.com
        server permit name oam-d09a.blue.aol.com
        audit-trail on
      application im msn
        service default action allow alarm
        service text-chat action allow alarm
        server permit name messenger.hotmail.com
        server permit name gateway.messenger.hotmail.com
        server permit name webmessenger.msn.com
        audit-trail on
      application http
        strict-http action allow alarm
        port-misuse im action reset alarm
        port-misuse p2p action reset alarm
        port-misuse tunneling action allow alarm
      application im yahoo
        service default action allow alarm
        service text-chat action allow alarm
        server permit name scs.msg.yahoo.com
        server permit name scsa.msg.yahoo.com
        server permit name scsb.msg.yahoo.com
        server permit name scsc.msg.yahoo.com
        server permit name scsd.msg.yahoo.com
        server permit name cs16.msg.dcn.yahoo.com
        server permit name cs19.msg.dcn.yahoo.com
        server permit name cs42.msg.dcn.yahoo.com
        server permit name cs53.msg.dcn.yahoo.com
        server permit name cs54.msg.dcn.yahoo.com
        server permit name ads1.vip.scd.yahoo.com
        server permit name radio1.launch.vip.dal.yahoo.com
        server permit name in1.msg.vip.re2.yahoo.com
        server permit name data1.my.vip.sc5.yahoo.com
        server permit name address1.pim.vip.mud.yahoo.com
        server permit name edit.messenger.yahoo.com
        server permit name messenger.yahoo.com
        server permit name http.pager.yahoo.com
        server permit name privacy.yahoo.com
        server permit name csa.yahoo.com
        server permit name csb.yahoo.com
        server permit name csc.yahoo.com
        audit-trail on
    parameter-map type inspect global
    log dropped-packets enable
    multilink bundle-name authenticated
    redundancy
    ip tcp synwait-time 10
    class-map match-any CCP-Transactional-1
    match dscp af21
    match dscp af22
    match dscp af23
    class-map match-any CCP-Voice-1
    match dscp ef
    class-map match-any sdm_p2p_kazaa
    match protocol fasttrack
    match protocol kazaa2
    class-map match-any CCP-Routing-1
    match dscp cs6
    class-map match-any sdm_p2p_edonkey
    match protocol edonkey
    class-map match-any CCP-Signaling-1
    match dscp cs3
    match dscp af31
    class-map match-any sdm_p2p_gnutella
    match protocol gnutella
    class-map match-any CCP-Management-1
    match dscp cs2
    class-map match-any sdm_p2p_bittorrent
    match protocol bittorrent
    policy-map sdm-qos-test-123
    class class-default
    policy-map sdmappfwp2p_CCP_MEDIUM
    class sdm_p2p_edonkey
    class sdm_p2p_gnutella
    class sdm_p2p_kazaa
    class sdm_p2p_bittorrent
    policy-map CCP-QoS-Policy-1
    class sdm_p2p_edonkey
    class sdm_p2p_gnutella
    class sdm_p2p_kazaa
    class sdm_p2p_bittorrent
    class CCP-Voice-1
      priority percent 33
    class CCP-Signaling-1
      bandwidth percent 5
    class CCP-Routing-1
      bandwidth percent 5
    class CCP-Management-1
      bandwidth percent 5
    class CCP-Transactional-1
      bandwidth percent 5
    class class-default
      fair-queue
      random-detect
    crypto ctcp port 10000
    crypto isakmp policy 1
    encr 3des
    authentication pre-share
    group 2
    crypto isakmp key REMOVED address 62.20.xxx.yyy 
    crypto isakmp key REMOVED address 195.243.xxx.yyy
    crypto isakmp key REMOVED address 195.243.xxx.yyy
    crypto isakmp key REMOVED address 83.140.xxx.yyy  
    crypto isakmp client configuration group VPN_local
    key REMOVED
    dns 10.133.10.5 10.133.10.7
    wins 10.133.10.7
    domain domain.de
    pool SDM_POOL_2
    acl 115
    crypto isakmp profile ciscocp-ike-profile-1
       match identity group VPN_local
       client authentication list ciscocp_vpn_xauth_ml_2
       isakmp authorization list ciscocp_vpn_group_ml_2
       client configuration address respond
       virtual-template 1
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA1 esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA2 esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA3 esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA4 esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA11 esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA5 esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-SHA1 esp-des esp-sha-hmac
    crypto ipsec profile CiscoCP_Profile1
    set transform-set ESP-3DES-SHA11
    set isakmp-profile ciscocp-ike-profile-1
    crypto map SDM_CMAP_1 1 ipsec-isakmp
    description Tunnel to62.20.xxx.xxx
    set peer 62.20.xxx.xxx
    set transform-set ESP-3DES-SHA
    match address 105
    crypto map SDM_CMAP_1 2 ipsec-isakmp
    description Tunnel to195.243.xxx.xxx
    set peer 195.243.xxx.xxx
    set transform-set ESP-3DES-SHA4
    match address 107
    crypto map SDM_CMAP_1 3 ipsec-isakmp
    description Tunnel to83.140.xxx.xxx
    set peer 83.140.xxx.xxx
    set transform-set ESP-DES-SHA1
    match address 118
    interface Loopback2
    ip address 192.168.10.1 255.255.254.0
    interface Null0
    no ip unreachables
    interface FastEthernet0
    switchport mode trunk
    no ip address
    spanning-tree portfast
    interface FastEthernet1
    no ip address
    spanning-tree portfast
    interface FastEthernet2
    no ip address
    spanning-tree portfast
    interface FastEthernet3
    no ip address
    spanning-tree portfast
    interface FastEthernet4
    description Internal LAN
    switchport access vlan 10
    switchport trunk native vlan 10
    no ip address
    spanning-tree portfast
    interface FastEthernet5
    no ip address
    spanning-tree portfast
    interface FastEthernet6
    no ip address
    spanning-tree portfast
    interface FastEthernet7
    no ip address
    spanning-tree portfast
    interface FastEthernet8
    description $FW_OUTSIDE$$ETH-WAN$
    ip address 62.153.xxx.xxx 255.255.255.248
    ip access-group 113 in
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    ip nat outside
    ip inspect CCP_MEDIUM out
    no ip virtual-reassembly in
    ip verify unicast reverse-path
    duplex auto
    speed auto
    crypto map SDM_CMAP_1
    service-policy input sdmappfwp2p_CCP_MEDIUM
    service-policy output CCP-QoS-Policy-1
    interface Virtual-Template1 type tunnel
    ip unnumbered FastEthernet8
    tunnel mode ipsec ipv4
    tunnel protection ipsec profile CiscoCP_Profile1
    interface GigabitEthernet0
    no ip address
    shutdown
    duplex auto
    speed auto
    interface Vlan1
    no ip address
    interface Vlan10
    description $FW_INSIDE$
    ip address 10.133.10.1 255.255.254.0
    ip access-group 112 in
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    ip flow ingress
    ip nat inside
    ip virtual-reassembly in
    interface Async1
    no ip address
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    encapsulation slip
    ip local pool SDM_POOL_1 192.168.10.101 192.168.10.200
    ip local pool VPN_Pool 192.168.20.2 192.168.20.100
    ip local pool SDM_POOL_2 172.16.100.2 172.16.100.100
    ip http server
    ip http access-class 23
    ip http authentication local
    ip http secure-server
    ip http timeout-policy idle 60 life 86400 requests 10000
    ip forward-protocol nd
    ip nat inside source route-map SDM_RMAP_1 interface FastEthernet8 overload
    ip route 0.0.0.0 0.0.0.0 62.153.xxx.xxx
    ip access-list extended VPN1
    remark VPN_Haberstrasse
    remark CCP_ACL Category=4
    permit ip 10.133.10.0 0.0.1.255 10.133.34.0 0.0.1.255
    ip radius source-interface Vlan10
    access-list 1 remark INSIDE_IF=Vlan1
    access-list 1 remark CCP_ACL Category=2
    access-list 1 permit 10.10.10.0 0.0.0.7
    access-list 23 remark CCP_ACL Category=17
    access-list 23 permit 195.243.xxx.xxx
    access-list 23 permit 10.133.10.0 0.0.1.255
    access-list 23 permit 10.10.10.0 0.0.0.7
    access-list 100 remark CCP_ACL Category=4
    access-list 100 permit ip 10.133.10.0 0.0.1.255 any
    access-list 101 remark CCP_ACL Category=16
    access-list 101 permit udp any eq bootps any eq bootpc
    access-list 101 deny   ip 10.10.10.0 0.0.0.255 any
    access-list 101 permit icmp any any echo-reply
    access-list 101 permit icmp any any time-exceeded
    access-list 101 permit icmp any any unreachable
    access-list 101 deny   ip 10.0.0.0 0.255.255.255 any
    access-list 101 deny   ip 172.16.0.0 0.15.255.255 any
    access-list 101 deny   ip 192.168.0.0 0.0.255.255 any
    access-list 101 deny   ip 127.0.0.0 0.255.255.255 any
    access-list 101 deny   ip host 255.255.255.255 any
    access-list 101 deny   ip any any
    access-list 102 remark auto generated by CCP firewall configuration
    access-list 102 remark CCP_ACL Category=1
    access-list 102 deny   ip 10.10.10.0 0.0.0.7 any
    access-list 102 permit icmp any host 62.153.xxx.xxx echo-reply
    access-list 102 permit icmp any host 62.153.xxx.xxx time-exceeded
    access-list 102 permit icmp any host 62.153.xxx.xxx unreachable
    access-list 102 deny   ip 10.0.0.0 0.255.255.255 any
    access-list 102 deny   ip 172.16.0.0 0.15.255.255 any
    access-list 102 deny   ip 192.168.0.0 0.0.255.255 any
    access-list 102 deny   ip 127.0.0.0 0.255.255.255 any
    access-list 102 deny   ip host 255.255.255.255 any
    access-list 102 deny   ip host 0.0.0.0 any
    access-list 102 deny   ip any any log
    access-list 103 remark auto generated by CCP firewall configuration
    access-list 103 remark CCP_ACL Category=1
    access-list 103 remark IPSec Rule
    access-list 103 permit ip 10.133.34.0 0.0.1.255 10.133.10.0 0.0.1.255
    access-list 103 remark IPSec Rule
    access-list 103 permit ip 10.133.34.0 0.0.1.255 192.168.10.0 0.0.1.255
    access-list 103 permit udp host 195.243.xxx.xxx host 62.153.xxx.xxx eq non500-isakmp
    access-list 103 permit udp host 195.243.xxx.xxx host 62.153.xxx.xxx eq isakmp
    access-list 103 permit esp host 195.243.xxx.xxx host 62.153.xxx.xxx
    access-list 103 permit ahp host 195.243.xxx.xxx host 62.153.xxx.xxx
    access-list 103 remark IPSec Rule
    access-list 103 permit ip 10.133.20.0 0.0.0.255 10.133.10.0 0.0.1.255
    access-list 103 remark IPSec Rule
    access-list 103 permit ip 192.168.10.0 0.0.1.255 10.133.10.0 0.0.1.255
    access-list 103 permit udp host 62.20.xxx.xxx host 62.153.xxx.xxx eq non500-isakmp
    access-list 103 permit udp host 62.20.xxx.xxx host 62.153.xxx.xxx eq isakmp
    access-list 103 permit esp host 62.20.xxx.xxx host 62.153.xxx.xxx
    access-list 103 permit ahp host 62.20.xxx.xxx host 62.153.xxx.xxx
    access-list 103 permit udp any host 62.153.xxx.xxx eq non500-isakmp
    access-list 103 permit udp any host 62.153.xxx.xxx eq isakmp
    access-list 103 permit esp any host 62.153.xxx.xxx
    access-list 103 permit ahp any host 62.153.xxx.xxx
    access-list 103 permit udp host 194.25.0.60 eq domain any
    access-list 103 permit udp host 194.25.0.68 eq domain any
    access-list 103 permit udp host 194.25.0.68 eq domain host 62.153.xxx.xxx
    access-list 103 deny   ip 10.10.10.0 0.0.0.7 any
    access-list 103 permit icmp any host 62.153.xxx.xxx echo-reply
    access-list 103 permit icmp any host 62.153.xxx.xxx time-exceeded
    access-list 103 permit icmp any host 62.153.xxx.xxx unreachable
    access-list 103 deny   ip 10.0.0.0 0.255.255.255 any
    access-list 103 deny   ip 172.16.0.0 0.15.255.255 any
    access-list 103 deny   ip 192.168.0.0 0.0.255.255 any
    access-list 103 deny   ip 127.0.0.0 0.255.255.255 any
    access-list 103 deny   ip host 255.255.255.255 any
    access-list 103 deny   ip host 0.0.0.0 any
    access-list 103 deny   ip any any log
    access-list 104 remark CCP_ACL Category=4
    access-list 104 permit ip 10.133.10.0 0.0.1.255 any
    access-list 105 remark CCP_ACL Category=4
    access-list 105 remark IPSec Rule
    access-list 105 permit ip 10.133.10.0 0.0.1.255 10.133.20.0 0.0.0.255
    access-list 106 remark CCP_ACL Category=2
    access-list 106 remark IPSec Rule
    access-list 106 deny   ip 192.168.10.0 0.0.1.255 10.133.34.0 0.0.1.255
    access-list 106 remark IPSec Rule
    access-list 106 deny   ip 192.168.10.0 0.0.1.255 10.60.16.0 0.0.0.255
    access-list 106 remark IPSec Rule
    access-list 106 deny   ip 10.133.10.0 0.0.1.255 10.60.16.0 0.0.0.255
    access-list 106 remark IPSec Rule
    access-list 106 deny   ip 10.133.10.0 0.0.1.255 10.133.34.0 0.0.1.255
    access-list 106 remark IPSec Rule
    access-list 106 deny   ip 10.133.10.0 0.0.1.255 10.133.20.0 0.0.0.255
    access-list 106 permit ip 10.10.10.0 0.0.0.7 any
    access-list 106 permit ip 10.133.10.0 0.0.1.255 any
    access-list 107 remark CCP_ACL Category=4
    access-list 107 remark IPSec Rule
    access-list 107 permit ip 10.133.10.0 0.0.1.255 10.133.34.0 0.0.1.255
    access-list 107 remark IPSec Rule
    access-list 107 permit ip 192.168.10.0 0.0.1.255 10.133.34.0 0.0.1.255
    access-list 108 remark Auto generated by SDM Management Access feature
    access-list 108 remark CCP_ACL Category=1
    access-list 108 permit tcp 10.133.10.0 0.0.1.255 host 10.133.10.1 eq telnet
    access-list 108 permit tcp 10.133.10.0 0.0.1.255 host 10.133.10.1 eq 22
    access-list 108 permit tcp 10.133.10.0 0.0.1.255 host 10.133.10.1 eq www
    access-list 108 permit tcp 10.133.10.0 0.0.1.255 host 10.133.10.1 eq 443
    access-list 108 permit tcp 10.133.10.0 0.0.1.255 host 10.133.10.1 eq cmd
    access-list 108 deny   tcp any host 10.133.10.1 eq telnet
    access-list 108 deny   tcp any host 10.133.10.1 eq 22
    access-list 108 deny   tcp any host 10.133.10.1 eq www
    access-list 108 deny   tcp any host 10.133.10.1 eq 443
    access-list 108 deny   tcp any host 10.133.10.1 eq cmd
    access-list 108 deny   udp any host 10.133.10.1 eq snmp
    access-list 108 permit ip any any
    access-list 109 remark CCP_ACL Category=1
    access-list 109 permit ip 10.133.10.0 0.0.1.255 any
    access-list 109 permit ip 10.10.10.0 0.0.0.7 any
    access-list 109 permit ip 192.168.10.0 0.0.1.255 any
    access-list 110 remark CCP_ACL Category=1
    access-list 110 permit ip host 195.243.xxx.xxx any
    access-list 110 permit ip host 84.44.xxx.xxx any
    access-list 110 permit ip 10.133.10.0 0.0.1.255 any
    access-list 110 permit ip 10.10.10.0 0.0.0.7 any
    access-list 110 permit ip 192.168.10.0 0.0.1.255 any
    access-list 111 remark CCP_ACL Category=4
    access-list 111 permit ip 10.133.10.0 0.0.1.255 any
    access-list 112 remark CCP_ACL Category=1
    access-list 112 permit udp host 10.133.10.5 eq 1812 any
    access-list 112 permit udp host 10.133.10.5 eq 1813 any
    access-list 112 permit udp any host 10.133.10.1 eq non500-isakmp
    access-list 112 permit udp any host 10.133.10.1 eq isakmp
    access-list 112 permit esp any host 10.133.10.1
    access-list 112 permit ahp any host 10.133.10.1
    access-list 112 permit udp host 10.133.10.5 eq 1645 host 10.133.10.1
    access-list 112 permit udp host 10.133.10.5 eq 1646 host 10.133.10.1
    access-list 112 remark auto generated by CCP firewall configuration
    access-list 112 permit udp host 10.133.10.5 eq 1812 host 10.133.10.1
    access-list 112 permit udp host 10.133.10.5 eq 1813 host 10.133.10.1
    access-list 112 permit udp host 10.133.10.7 eq domain any
    access-list 112 permit udp host 10.133.10.5 eq domain any
    access-list 112 deny   ip 62.153.xxx.xxx 0.0.0.7 any
    access-list 112 deny   ip 10.10.10.0 0.0.0.7 any
    access-list 112 deny   ip host 255.255.255.255 any
    access-list 112 deny   ip 127.0.0.0 0.255.255.255 any
    access-list 112 permit ip any any
    access-list 113 remark CCP_ACL Category=1
    access-list 113 remark IPSec Rule
    access-list 113 permit ip 10.133.34.0 0.0.1.255 192.168.10.0 0.0.1.255
    access-list 113 remark IPSec Rule
    access-list 113 permit ip 10.60.16.0 0.0.0.255 192.168.10.0 0.0.1.255
    access-list 113 remark IPSec Rule
    access-list 113 permit ip 10.60.16.0 0.0.0.255 10.133.10.0 0.0.1.255
    access-list 113 permit udp host 83.140.100.4 host 62.153.xxx.xxx eq non500-isakmp
    access-list 113 permit udp host 83.140.100.4 host 62.153.xxx.xxx eq isakmp
    access-list 113 permit esp host 83.140.100.4 host 62.153.xxx.xxx
    access-list 113 permit ahp host 83.140.100.4 host 62.153.xxx.xxx
    access-list 113 permit ip host 195.243.xxx.xxx host 62.153.xxx.xxx
    access-list 113 permit ip host 84.44.xxx.xxx host 62.153.xxx.xxx
    access-list 113 remark auto generated by CCP firewall configuration
    access-list 113 permit udp host 194.25.0.60 eq domain any
    access-list 113 permit udp host 194.25.0.68 eq domain any
    access-list 113 permit udp host 194.25.0.68 eq domain host 62.153.xxx.xxx
    access-list 113 permit udp host 194.25.0.60 eq domain host 62.153.xxx.xxx
    access-list 113 permit udp any host 62.153.xxx.xxx eq non500-isakmp
    access-list 113 permit udp any host 62.153.xxx.xxx eq isakmp
    access-list 113 permit esp any host 62.153.xxx.xxx
    access-list 113 permit ahp any host 62.153.xxx.xxx
    access-list 113 permit ahp host 195.243.xxx.xxx host 62.153.xxx.xxx
    access-list 113 permit esp host 195.243.xxx.xxx host 62.153.xxx.xxx
    access-list 113 permit udp host 195.243.xxx.xxx host 62.153.xxx.xxx eq isakmp
    access-list 113 permit udp host 195.243.xxx.xxx host 62.153.xxx.xxx eq non500-isakmp
    access-list 113 remark IPSec Rule
    access-list 113 permit ip 10.133.34.0 0.0.1.255 10.133.10.0 0.0.1.255
    access-list 113 permit ahp host 62.20.xxx.xxx host 62.153.xxx.xxx
    access-list 113 remark IPSec Rule
    access-list 113 permit ip 192.168.10.0 0.0.1.255 10.133.10.0 0.0.1.255
    access-list 113 permit esp host 62.20.xxx.xxx host 62.153.xxx.xxx
    access-list 113 permit udp host 62.20.xxx.xxx host 62.153.xxx.xxx eq isakmp
    access-list 113 permit udp host 62.20.xxx.xxx host 62.153.xxx.xxx eq non500-isakmp
    access-list 113 remark IPSec Rule
    access-list 113 permit ip 10.133.20.0 0.0.0.255 10.133.10.0 0.0.1.255
    access-list 113 remark Pop3
    access-list 113 permit tcp host 82.127.xxx.xxx eq 8080 host 62.153.xxx.xxx
    access-list 113 remark Pop3
    access-list 113 permit tcp any eq pop3 host 62.153.xxx.xxx
    access-list 113 remark SMTP
    access-list 113 permit tcp any eq 465 host 62.153.xxx.xxx
    access-list 113 remark IMAP
    access-list 113 permit tcp any eq 587 host 62.153.xxx.xxx
    access-list 113 deny   ip 10.133.10.0 0.0.1.255 any
    access-list 113 deny   ip 10.10.10.0 0.0.0.7 any
    access-list 113 permit icmp any host 62.153.xxx.xxx echo-reply
    access-list 113 permit icmp any host 62.153.xxx.xxx time-exceeded
    access-list 113 permit icmp any host 62.153.xxx.xxx unreachable
    access-list 113 deny   ip 10.0.0.0 0.255.255.255 any
    access-list 113 deny   ip 172.16.0.0 0.15.255.255 any
    access-list 113 deny   ip 192.168.0.0 0.0.255.255 any
    access-list 113 deny   ip 127.0.0.0 0.255.255.255 any
    access-list 113 deny   ip host 255.255.255.255 any
    access-list 113 deny   ip host 0.0.0.0 any
    access-list 113 deny   ip any any log
    access-list 114 remark auto generated by CCP firewall configuration
    access-list 114 remark CCP_ACL Category=1
    access-list 114 deny   ip 10.133.10.0 0.0.1.255 any
    access-list 114 deny   ip 10.10.10.0 0.0.0.7 any
    access-list 114 permit icmp any any echo-reply
    access-list 114 permit icmp any any time-exceeded
    access-list 114 permit icmp any any unreachable
    access-list 114 deny   ip 10.0.0.0 0.255.255.255 any
    access-list 114 deny   ip 172.16.0.0 0.15.255.255 any
    access-list 114 deny   ip 192.168.0.0 0.0.255.255 any
    access-list 114 deny   ip 127.0.0.0 0.255.255.255 any
    access-list 114 deny   ip host 255.255.255.255 any
    access-list 114 deny   ip host 0.0.0.0 any
    access-list 114 deny   ip any any log
    access-list 115 remark VPN_Sub
    access-list 115 remark CCP_ACL Category=5
    access-list 115 permit ip 10.133.10.0 0.0.1.255 172.16.0.0 0.0.255.255
    access-list 115 permit ip 10.133.34.0 0.0.1.255 172.16.0.0 0.0.255.255
    access-list 115 permit ip 10.133.20.0 0.0.0.255 any
    access-list 116 remark CCP_ACL Category=4
    access-list 116 remark IPSec Rule
    access-list 116 permit ip 10.133.10.0 0.0.1.255 10.60.16.0 0.0.0.255
    access-list 117 remark CCP_ACL Category=4
    access-list 117 remark IPSec Rule
    access-list 117 permit ip 10.133.10.0 0.0.1.255 10.60.16.0 0.0.0.255
    access-list 118 remark CCP_ACL Category=4
    access-list 118 remark IPSec Rule
    access-list 118 permit ip 10.133.10.0 0.0.1.255 10.60.16.0 0.0.0.255
    access-list 118 remark IPSec Rule
    access-list 118 permit ip 192.168.10.0 0.0.1.255 10.60.16.0 0.0.0.255
    no cdp run
    route-map SDM_RMAP_1 permit 1
    match ip address 106
    control-plane
    mgcp profile default
    line con 0
    transport output telnet
    line 1
    modem InOut
    speed 115200
    flowcontrol hardware
    line aux 0
    transport output telnet
    line vty 0 4
    session-timeout 45
    access-class 110 in
    transport input telnet ssh
    line vty 5 15
    access-class 109 in
    transport input telnet ssh
    scheduler interval 500
    end

    The crypto ACL for the site to site vpn should also include the vpn client pool, otherwise, traffic from the vpn client does not match the interesting traffic for the site to site vpn.
    On Site A:
    should include "access-list 107 permit ip 172.16.100.0 0.0.0.255 10.133.34.0 0.0.1.255"
    You should also remove the following line as the pool is incorrect:
    access-list 107 permit ip 192.168.10.0 0.0.1.255 10.133.34.0 0.0.1.255
    On Site B:
    should include: permit ip 10.133.34.0 0.0.1.255 172.16.100.0 0.0.0.255"
    NAT exemption on site B should also be configured with deny on the above ACL.

  • Network LAN Setup Help

    I have a cisco 891 router, and 3 unmanaged switches that i would like to use to segment my small office network into 3 VLANs groups to help reduce out current bottleneck we are having in our network. From everything i read i should be able to setup 3 VLANs on the router, and pick 3 out of the 8 ports on the router to be switchports for each of the 3 VLANs, and each of the 3 switches would connect to those.
    My question is, when i setup the VLAN i cannot access the internet, though the inital VLAN 1 which currenlty has all our office computers sharing 1 switch and 1 VLAN works fine, any ideas? Is segmenting our network via 3 switches and 3 VLANs going to help with overall bandwidth?
    My last question is, what are the proper steps to setup each VLAN on the router so i can access the internet with them and achieve the increased bandwidth through segmenting each office group?
    I am new to cisco routers, so any help you can give me would be great.

    Thanks for your help. I think ive helped myself on the bandwidth end by spliting up my office on to 3 switches, but still using 1 VLAN. Before we had 16 people using 1 100Mbps link to the router which was at times getting maxed. Now i have it split across 3. But for security reasons with accounting and such i still want to setup 3 vlans. Here is the version information on the router:
    Cisco IOS Software, C890 Software (C890-UNIVERSALK9-M), Version 12.4(22)YB, RELEASE SOFTWARE (fc2)
    Technical Support: http://www.cisco.com/techsupport
    Copyright (c) 1986-2009 by Cisco Systems, Inc.
    Compiled Tue 27-Jan-09 02:48 by prod_rel_team
    ROM: System Bootstrap, Version 12.4(22r)YB3, RELEASE SOFTWARE (fc1)
    yourname uptime is 3 days, 5 hours, 24 minutes
    System returned to ROM by reload at 10:18:03 PCTime Fri Oct 8 2010
    System image file is "flash:c890-universalk9-mz.124-22.YB.bin"
    Last reload reason: Reload Command
    This product contains cryptographic features and is subject to United
    States and local country laws governing import, export, transfer and
    use. Delivery of Cisco cryptographic products does not imply
    third-party authority to import, export, distribute or use encryption.
    Importers, exporters, distributors and users are responsible for
    compliance with U.S. and local country laws. By using this product you
    agree to comply with applicable laws and regulations. If you are unable
    to comply with U.S. and local laws, return this product immediately.
    A summary of U.S. laws governing Cisco cryptographic products may be found at:
    http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
    If you require further assistance please contact us by sending email to
    [email protected].
    Cisco 891 (MPC8300) processor (revision 1.0) with 498688K/25600K bytes of memory.
    Processor board ID FTX134680PV
    9 FastEthernet interfaces
    1 Gigabit Ethernet interface
    1 Serial interface
    1 terminal line
    256K bytes of non-volatile configuration memory.
    250880K bytes of ATA CompactFlash (Read/Write)
    License Information for 'c890'
        License Level: advipservices   Type: Permanent
        Next reboot license Level: advipservices
    Configuration register is 0x2102
    Current configuration : 12609 bytes
    version 12.4
    no service pad
    service tcp-keepalives-in
    service tcp-keepalives-out
    service timestamps debug datetime msec localtime show-timezone
    service timestamps log datetime msec localtime show-timezone
    service password-encryption
    service sequence-numbers
    hostname yourname
    boot-start-marker
    boot-end-marker
    security authentication failure rate 3 log
    security passwords min-length 6
    logging message-counter syslog
    logging buffered 51200
    logging console critical
    enable secret 5 ***********************
    aaa new-model
    aaa authentication login default local
    aaa authentication login ciscocp_vpn_xauth_ml_1 local
    aaa authentication login ciscocp_vpn_xauth_ml_2 local
    aaa authentication login ciscocp_vpn_xauth_ml_3 local
    aaa authorization exec default local
    aaa authorization network ciscocp_vpn_group_ml_1 local
    aaa session-id common
    clock timezone PCTime -5
    clock summer-time PCTime date Apr 6 2003 2:00 Oct 26 2003 2:00
    crypto pki trustpoint TP-self-signed-2084037767
    enrollment selfsigned
    subject-name cn=IOS-Self-Signed-Certificate-2084037767
    revocation-check none
    rsakeypair TP-self-signed-2084037767
    crypto pki certificate chain TP-self-signed-2084037767
    certificate self-signed 01
            quit
    no ip source-route
    ip dhcp pool data-vlan-10
       import all
       network 10.10.10.0 255.255.255.0
       dns-server *****************(OUTSIDE IP)
       default-router 10.10.10.1
    ip cef
    no ip bootp server
    ip domain name yourdomain.com
    ip name-server *****************(OUTSIDE IP)
    ip name-server *****************(OUTSIDE IP)
    ip port-map user-protocol--1 port tcp 3389
    no ipv6 cef
    multilink bundle-name authenticated
    crypto isakmp policy 1
    encr 3des
    authentication pre-share
    group 2
    crypto isakmp client configuration group Everyone
    key *********
    crypto isakmp client configuration group user
    key **********
    pool SDM_POOL_1
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ctcp port 10000
    archive
    log config
      hidekeys
    ip tcp synwait-time 10
    ip ssh time-out 60
    ip ssh authentication-retries 2
    class-map type inspect match-all sdm-nat-user-protocol--1-1
    match access-group 102
    match protocol user-protocol--1
    class-map type inspect match-any ccp-skinny-inspect
    match protocol skinny
    class-map type inspect match-any SDM_WEBVPN
    match access-group name SDM_WEBVPN
    class-map type inspect match-all SDM_WEBVPN_TRAFFIC
    match class-map SDM_WEBVPN
    match access-group 103
    class-map type inspect match-any ccp-cls-insp-traffic
    match protocol cuseeme
    match protocol dns
    match protocol ftp
    match protocol https
    match protocol icmp
    match protocol imap
    match protocol pop3
    match protocol netshow
    match protocol shell
    match protocol realmedia
    match protocol rtsp
    match protocol smtp extended
    match protocol sql-net
    match protocol streamworks
    match protocol tftp
    match protocol vdolive
    match protocol tcp
    match protocol udp
    class-map type inspect match-all ccp-insp-traffic
    match class-map ccp-cls-insp-traffic
    class-map match-any CCP-Transactional-1
    match  dscp af21
    match  dscp af22
    match  dscp af23
    class-map type inspect match-any ccp-h323nxg-inspect
    match protocol h323-nxg
    class-map type inspect match-any ccp-cls-icmp-access
    match protocol icmp
    match protocol tcp
    match protocol udp
    class-map match-any CCP-Voice-1
    match  dscp ef
    class-map type inspect match-any ccp-h225ras-inspect
    match protocol h225ras
    class-map match-any CCP-Routing-1
    match  dscp cs6
    class-map match-any CCP-Signaling-1
    match  dscp cs3
    match  dscp af31
    class-map type inspect match-any ccp-h323annexe-inspect
    match protocol h323-annexe
    class-map match-any CCP-Management-1
    match  dscp cs2
    class-map type inspect match-any ccp-h323-inspect
    match protocol h323
    class-map type inspect match-all ccp-icmp-access
    match class-map ccp-cls-icmp-access
    class-map type inspect match-all ccp-invalid-src
    match access-group 101
    class-map type inspect match-any ccp-sip-inspect
    match protocol sip
    class-map type inspect match-all ccp-protocol-http
    match protocol http
    policy-map CCP-QoS-Policy-1
    class CCP-Voice-1
        priority percent 33
    class CCP-Signaling-1
        bandwidth percent 5
    class CCP-Routing-1
        bandwidth percent 5
    class CCP-Management-1
        bandwidth percent 5
    class CCP-Transactional-1
        bandwidth percent 5
    class class-default
        fair-queue
         random-detect
    policy-map type inspect ccp-permit-icmpreply
    class type inspect ccp-icmp-access
      inspect
    class class-default
      pass
    policy-map type inspect sdm-pol-NATOutsideToInside-1
    class type inspect sdm-nat-user-protocol--1-1
      inspect
    class class-default
      drop
    policy-map type inspect ccp-inspect
    class type inspect ccp-invalid-src
      drop log
    class type inspect ccp-protocol-http
      inspect
    class type inspect ccp-insp-traffic
      inspect
    class type inspect ccp-sip-inspect
      inspect
    class type inspect ccp-h323-inspect
      inspect
    class type inspect ccp-h323annexe-inspect
      inspect
    class type inspect ccp-h225ras-inspect
      inspect
    class type inspect ccp-h323nxg-inspect
      inspect
    class type inspect ccp-skinny-inspect
      inspect
    class class-default
      drop
    policy-map type inspect ccp-permit
    class type inspect SDM_WEBVPN_TRAFFIC
      inspect
    class class-default
      drop
    zone security out-zone
    zone security in-zone
    zone-pair security ccp-zp-self-out source self destination out-zone
    service-policy type inspect ccp-permit-icmpreply
    zone-pair security sdm-zp-NATOutsideToInside-1 source out-zone destination in-zone
    service-policy type inspect sdm-pol-NATOutsideToInside-1
    zone-pair security ccp-zp-in-out source in-zone destination out-zone
    service-policy type inspect ccp-inspect
    zone-pair security ccp-zp-out-self source out-zone destination self
    service-policy type inspect ccp-permit
    interface Loopback0
    description Do not delete - SDM WebVPN generated interface
    ip address 192.168.1.1 255.255.255.252
    ip nat inside
    ip virtual-reassembly
    interface Null0
    no ip unreachables
    interface FastEthernet0
    interface FastEthernet1
    interface FastEthernet2
    interface FastEthernet3
    interface FastEthernet4
    interface FastEthernet5
    interface FastEthernet6
    interface FastEthernet7
    interface FastEthernet8
    description $ES_WAN$$ETH-WAN$$FW_OUTSIDE$
    ip address *****************(OUTSIDE IP) 255.255.255.248
    ip verify unicast reverse-path
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    ip nbar protocol-discovery
    ip flow ingress
    ip nat outside
    ip virtual-reassembly
    zone-member security out-zone
    duplex full
    speed 100
    snmp trap ip verify drop-rate
    service-policy output CCP-QoS-Policy-1
    interface GigabitEthernet0
    no ip address
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    ip flow ingress
    shutdown
    duplex auto
    speed auto
    interface Vlan1
    description $ETH-SW-LAUNCH$$INTF-INFO-FE 1$$FW_INSIDE$
    ip address 10.10.10.1 255.255.255.0
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    ip flow ingress
    ip nat inside
    ip virtual-reassembly
    zone-member security in-zone
    ip tcp adjust-mss 1452
    interface Async1
    no ip address
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    encapsulation slip
    ip local pool SDM_POOL_1 10.10.10.50 10.10.10.60
    ip forward-protocol nd
    ip route 0.0.0.0 0.0.0.0 *****************(OUTSIDE IP) 2
    ip http server
    ip http access-class 23
    ip http authentication local
    ip http secure-server
    ip http timeout-policy idle 60 life 86400 requests 10000
    ip flow-top-talkers
    top 10
    sort-by bytes
    cache-timeout 6000
    ip nat inside source list 100 interface FastEthernet8 overload
    ip nat inside source static tcp 10.10.10.71 3389 interface FastEthernet8 3389
    ip nat inside source static tcp 192.168.1.1 443 *****************(OUTSIDE IP) 4443 extendable
    ip access-list extended SDM_WEBVPN
    remark CCP_ACL Category=1
    permit tcp any any eq 443
    logging trap debugging
    access-list 23 permit 10.10.10.0 0.0.0.7
    access-list 23 permit 10.10.10.0 0.0.0.255
    access-list 100 permit ip 10.10.10.0 0.0.0.255 any
    access-list 101 remark CCP_ACL Category=128
    access-list 101 permit ip host 255.255.255.255 any
    access-list 101 permit ip 127.0.0.0 0.255.255.255 any
    access-list 101 permit ip**********************(OUTSIDE IP) 0.0.0.7 any
    access-list 102 remark CCP_ACL Category=0
    access-list 102 permit ip any host 10.10.10.71
    access-list 103 remark CCP_ACL Category=128
    access-list 103 permit ip any host *****************(OUTSIDE IP)
    no cdp run
    control-plane
    banner exec ^C
    % Password expiration warning.
    Cisco Configuration Professional (Cisco CP) is installed on this device
    and it provides the default username "cisco" for  one-time use. If you have
    already used the username "cisco" to login to the router and your IOS image
    supports the "one-time" user option, then this username has already expired.
    You will not be able to login to the router with this username after you exit
    this session.
    It is strongly suggested that you create a new username with a privilege level
    of 15 using the following command.
    username privilege 15 secret 0
    Replace and with the username and password you want to
    use.
    ^C
    banner login ^C
    Cisco Configuration Professional (Cisco CP) is installed on this device.
    This feature requires the one-time use of the username "cisco" with the
    password "cisco". These default credentials have a privilege level of 15.
    YOU MUST USE CISCO CP or the CISCO IOS CLI TO CHANGE THESE  PUBLICLY-KNOWN
    CREDENTIALS
    Here are the Cisco IOS commands.
    username   privilege 15 secret 0
    no username cisco
    Replace and with the username and password you want
    to use.
    IF YOU DO NOT CHANGE THE PUBLICLY-KNOWN CREDENTIALS, YOU WILL NOT BE ABLE
    TO LOG INTO THE DEVICE AGAIN AFTER YOU HAVE LOGGED OFF.
    For more information about Cisco CP please follow the instructions in the
    QUICK START GUIDE for your router or go to http://www.cisco.com/go/ciscocp
    ^C
    line con 0
    transport output telnet
    Replace and with the username and password you want
    to use.
    IF YOU DO NOT CHANGE THE PUBLICLY-KNOWN CREDENTIALS, YOU WILL NOT BE ABLE
    TO LOG INTO THE DEVICE AGAIN AFTER YOU HAVE LOGGED OFF.
    For more information about Cisco CP please follow the instructions in the
    QUICK START GUIDE for your router or go to http://www.cisco.com/go/ciscocp
    ^C
    line con 0
    transport output telnet
    line 1
    modem InOut
    stopbits 1
    speed 115200
    flowcontrol hardware
    line aux 0
    transport output telnet
    line vty 0 4
    privilege level 15
    transport input telnet ssh
    line vty 5 15
    privilege level 15
    transport input telnet ssh
    scheduler max-task-time 5000
    scheduler allocate 4000 1000
    scheduler interval 500
    webvpn gateway gateway_1
    ip address 72.242.1.187 port 443
    http-redirect port 80
    ssl trustpoint TP-self-signed-2084037767
    inservice
    webvpn install svc flash:/webvpn/svc_1.pkg sequence 1
    webvpn install csd flash:/webvpn/sdesktop.pkg
    webvpn context VPN
    secondary-color white
    title-color #CCCC66
    text-color black
    ssl authenticate verify all
    policy group policy_1
       functions svc-enabled
       svc address-pool "SDM_POOL_1"
       svc keep-client-installed
    default-group-policy policy_1
    aaa authentication list ciscocp_vpn_xauth_ml_3
    gateway gateway_1 domain pwvpn
    inservice
    end
    So thats the config right now, i have not added the vlans yet, because when i did it shutdown all our network, so i went back to our working config. So if you can tell me what steps i need to setup the vlans that would be great. I need to start another thread about VPNS, cause i cant get our VPN working either but thats another story

  • Cisco 2811 - Multiple SIP with CME 8.6

    PLAN:
    Configure two SIP providers with my Cisco ISR 2811 using CME 8.6
    sip.fongo.com
    sip.voicediscount.com
    All incoming and local outgoing calls using fongo, while long distance & international via voipdiscount.
    I have successfully got fongo.com service to work for both incoming and outgoing, however when I try a long distance & international calls I get a busy tone.
    Any help will be appreciated since I've had no luck
    CONFIG:
    BNET01C2811-TOR1807#sh run
    Building configuration...
    Current configuration : 19512 bytes
    ! Last configuration change at 21:48:40 EDT Sat Oct 27 2012 by garrett
    ! NVRAM config last updated at 21:50:55 EDT Sat Oct 27 2012 by garrett
    ! NVRAM config last updated at 21:50:55 EDT Sat Oct 27 2012 by garrett
    version 15.1
    no service pad
    service tcp-keepalives-in
    service tcp-keepalives-out
    service timestamps debug datetime msec localtime show-timezone
    service timestamps log datetime msec localtime show-timezone
    service password-encryption
    service sequence-numbers
    hostname BNET01C2811-TOR1807
    boot-start-marker
    boot system flash:c2800nm-adventerprisek9-mz.151-4.m5.bin
    boot-end-marker
    ! card type command needed for slot/vwic-slot 0/0
    security authentication failure rate 3 log
    security passwords min-length 6
    logging buffered 51200
    logging console critical
    enable secret 5 $1$r/t3$A3xgJf.ngqbUq.sDiNC4O0
    no aaa new-model
    clock timezone EST -4 0
    clock summer-time EDT recurring
    clock calendar-valid
    dot11 syslog
    no ip source-route
    ip cef
    no ip dhcp use vrf connected
    ip dhcp excluded-address 10.15.0.0 10.15.0.20
    ip dhcp pool TOR-1807WEBB
    network 10.15.0.0 255.255.255.0
    default-router 10.15.0.15
    dns-server 64.71.255.198
    option 150 ip 10.15.0.15
    no ip bootp server
    ip domain name bayross.net
    ip name-server 64.71.255.198
    ip ddns update method sdm_ddns1
    HTTP
      add http://bayross:******@members.dyndns.org/nic/update?system=dyndns&hostname=<h>&myip=<a>
      remove http://bayross:********@members.dyndns.org/nic/update?system=dyndns&hostname=<h>&myip=<a>
    interval maximum 1 1 0 0
    interval minimum 1 1 0 0
    no ipv6 cef
    multilink bundle-name authenticated
    parameter-map type protocol-info yahoo-servers
    server name scs.msg.yahoo.com
    server name scsa.msg.yahoo.com
    server name scsb.msg.yahoo.com
    server name scsc.msg.yahoo.com
    server name scsd.msg.yahoo.com
    server name cs16.msg.dcn.yahoo.com
    server name cs19.msg.dcn.yahoo.com
    server name cs42.msg.dcn.yahoo.com
    server name cs53.msg.dcn.yahoo.com
    server name cs54.msg.dcn.yahoo.com
    server name ads1.vip.scd.yahoo.com
    server name radio1.launch.vip.dal.yahoo.com
    server name in1.msg.vip.re2.yahoo.com
    server name data1.my.vip.sc5.yahoo.com
    server name address1.pim.vip.mud.yahoo.com
    server name edit.messenger.yahoo.com
    server name messenger.yahoo.com
    server name http.pager.yahoo.com
    server name privacy.yahoo.com
    server name csa.yahoo.com
    server name csb.yahoo.com
    server name csc.yahoo.com
    parameter-map type protocol-info aol-servers
    server name login.oscar.aol.com
    server name toc.oscar.aol.com
    server name oam-d09a.blue.aol.com
    parameter-map type protocol-info msn-servers
    server name messenger.hotmail.com
    server name gateway.messenger.hotmail.com
    server name webmessenger.msn.com
    voice service voip
    ip address trusted list
      ipv4 46.19.209.10
      ipv4 46.19.209.11
      ipv4 46.19.209.12
      ipv4 46.19.209.13
      ipv4 46.19.209.14
      ipv4 46.19.209.15
      ipv4 46.19.209.75
      ipv4 46.19.209.76
      ipv4 46.19.209.77
      ipv4 46.19.209.78
      ipv4 46.19.209.79
      ipv4 46.19.209.80
      ipv4 46.19.210.10
      ipv4 46.19.210.11
      ipv4 46.19.210.12
      ipv4 46.19.210.13
      ipv4 46.19.210.14
      ipv4 46.19.210.15
      ipv4 46.19.210.75
      ipv4 46.19.210.76
      ipv4 46.19.210.77
      ipv4 46.19.210.78
      ipv4 46.19.210.79
      ipv4 46.19.210.80
      ipv4 81.85.224.40
      ipv4 81.85.224.41
      ipv4 212.150.88.21
      ipv4 212.150.88.23
      ipv4 212.150.88.24
      ipv4 208.65.240.165
      ipv4 0.0.0.0 0.0.0.0
    allow-connections h323 to h323
    allow-connections h323 to sip
    allow-connections sip to h323
    allow-connections sip to sip
    supplementary-service h450.12
    redirect ip2ip
    fax protocol pass-through g711ulaw
    h323
      no h225 timeout keepalive
    voice class codec 1
    codec preference 1 g711ulaw
    codec preference 2 g711alaw
    voice register global
    mode cme
    source-address 10.15.0.15 port 5060
    max-dn 100
    max-pool 25
    tftp-path flash:
    create profile sync 0002145265491175
    camera
    voice translation-rule 2
    rule 1 /9905+/ /905/
    rule 2 /9416+/ /416/
    rule 3 /9647+/ /647/
    voice translation-rule 4
    rule 1 /91+/ /1/
    voice translation-rule 5
    rule 1 /9011+/ /011/
    voice translation-rule 7
    rule 1 /1011/ /16472473297/
    voice translation-rule 911
    rule 1 /111/ /6473385738/
    voice translation-rule 2473297
    rule 1 /16472473297/ /1011/
    voice translation-profile Caller-ID
    translate calling 7
    voice translation-profile Emergency
    translate called 911
    voice translation-profile Incoming
    translate called 2473297
    voice translation-profile International
    translate calling 7
    translate called 5
    voice translation-profile Local
    translate calling 7
    translate called 2
    voice translation-profile LongDistance
    translate calling 7
    translate called 4
    voice-card 0
    dsp services dspfarm
    crypto pki token default removal timeout 0
    crypto pki trustpoint TP-self-signed-21053818
    enrollment selfsigned
    subject-name cn=IOS-Self-Signed-Certificate-21053818
    revocation-check none
    rsakeypair TP-self-signed-21053818
    crypto pki trustpoint test_trustpoint_config_created_for_sdm
    subject-name [email protected]
    revocation-check crl
    crypto pki certificate chain TP-self-signed-21053818
    certificate self-signed 01
      30820227 30820190 A0030201 02020101 300D0609 2A864886 F70D0101 05050030
      2F312D30 2B060355 04031324 494F532D 53656C66 2D536967 6E65642D 43657274
      69666963 6174652D 32313035 33383138 301E170D 31323130 31373131 33303333
      5A170D32 30303130 31303030 3030305A 302F312D 302B0603 55040313 24494F53
      2D53656C 662D5369 676E6564 2D436572 74696669 63617465 2D323130 35333831
      3830819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281 8100B080
      AD5A9751 C15D5932 0677DBEF A59AF6B0 1EF55BE0 B1DFA4B8 397130B7 90BA221D
      5A03F805 DD546B79 D40CD413 3FD7CCFC A2137323 63E26137 8577DD77 C1787B0E
      ADC65091 042897A3 2F26DAC0 CCF0E0AC 604AA2B4 48616FE3 976E17B6 53ABC719
      16EFA128 8F883BFA 39FA02EF CA820300 4B650412 77418E6D AE45C6A1 0FEB0203
      010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603 551D2304
      18301680 14504E01 C3E57E38 CAB8659D 21D57880 66FE3CDB 83301D06 03551D0E
      04160414 504E01C3 E57E38CA B8659D21 D5788066 FE3CDB83 300D0609 2A864886
      F70D0101 05050003 81810049 A534494C B6777D5B FCAB252E 8FD03C10 D917714E
      3314139B 04FCB2CC 74C06091 D189470E 930CEA8A 393461A7 E505BB0A 59DEDF5C
      37711F56 127E22C6 CA9457EC 960A868D 37B24F75 A03B1F8B A611D77F 0E79B2D8
      135C57AF B9705B78 BA97BFF3 5967C1D1 6E2B92D3 A8BE055B 10A59F2C 5D28C55B
      2164E3C7 7F2380E1 E33AD4
            quit
    crypto pki certificate chain test_trustpoint_config_created_for_sdm
    license udi pid CISCO2811 sn FHK1041F27M
    username garrett privilege 15 password 7 070D000000094C50
    redundancy
    ip tcp synwait-time 10
    no ip ftp passive
    class-map type inspect match-any SDM_BOOTPC
    match access-group name SDM_BOOTPC
    class-map type inspect match-any ccp-cls-protocol-p2p
    match protocol edonkey signature
    match protocol gnutella signature
    match protocol kazaa2 signature
    match protocol fasttrack signature
    match protocol bittorrent signature
    class-map type inspect match-any SDM_DHCP_CLIENT_PT
    match class-map SDM_BOOTPC
    class-map type inspect match-any ccp-skinny-inspect
    match protocol skinny
    class-map type inspect match-any sdm-cls-bootps
    match protocol bootps
    class-map type inspect match-any ccp-cls-insp-traffic
    match protocol dns
    match protocol ftp
    match protocol https
    match protocol icmp
    match protocol imap
    match protocol pop3
    match protocol netshow
    match protocol shell
    match protocol realmedia
    match protocol rtsp
    match protocol smtp
    match protocol sql-net
    match protocol streamworks
    match protocol tftp
    match protocol vdolive
    match protocol tcp
    match protocol udp
    class-map type inspect match-all ccp-insp-traffic
    match class-map ccp-cls-insp-traffic
    class-map match-any CCP-Transactional-1
    match  dscp af21
    match  dscp af22
    match  dscp af23
    class-map type inspect match-any ccp-h323nxg-inspect
    match protocol h323-nxg
    class-map type inspect match-any ccp-cls-icmp-access
    match protocol icmp
    match protocol tcp
    match protocol udp
    class-map type inspect match-any ccp-cls-protocol-im
    match protocol ymsgr yahoo-servers
    match protocol msnmsgr msn-servers
    match protocol aol aol-servers
    class-map match-any CCP-Voice-1
    match  dscp ef
    class-map type inspect match-any ccp-h225ras-inspect
    match protocol h225ras
    class-map match-any CCP-Routing-1
    match  dscp cs6
    class-map match-any CCP-Signaling-1
    match  dscp cs3
    match  dscp af31
    class-map type inspect match-any ccp-h323annexe-inspect
    match protocol h323-annexe
    class-map match-any CCP-Management-1
    match  dscp cs2
    class-map type inspect match-any ccp-h323-inspect
    match protocol h323
    class-map type inspect match-all ccp-icmp-access
    match class-map ccp-cls-icmp-access
    class-map type inspect match-all ccp-invalid-src
    match access-group 100
    class-map type inspect match-any ccp-sip-inspect
    match protocol sip
    class-map type inspect match-all ccp-protocol-http
    match protocol http
    policy-map CCP-QoS-Policy-1
    class CCP-Voice-1
      priority percent 33
    class CCP-Signaling-1
      bandwidth percent 5
    class CCP-Routing-1
      bandwidth percent 5
    class CCP-Management-1
      bandwidth percent 5
    class CCP-Transactional-1
      bandwidth percent 5
    class class-default
      fair-queue
      random-detect
    policy-map type inspect ccp-permit-icmpreply
    class type inspect sdm-cls-bootps
      pass
    class type inspect ccp-sip-inspect
      pass
    class type inspect ccp-h323-inspect
      inspect
    class type inspect ccp-h323annexe-inspect
      inspect
    class type inspect ccp-h225ras-inspect
      inspect
    class type inspect ccp-h323nxg-inspect
      inspect
    class type inspect ccp-skinny-inspect
      inspect
    class type inspect ccp-icmp-access
      inspect
    class class-default
      pass
    policy-map sdm-qos-test-123
    class class-default
    policy-map type inspect ccp-inspect
    class type inspect ccp-invalid-src
      drop log
    class type inspect ccp-protocol-http
      inspect
    class type inspect ccp-insp-traffic
      inspect
    class type inspect ccp-sip-inspect
      pass
    class type inspect ccp-h323-inspect
      inspect
    class type inspect ccp-h323annexe-inspect
      inspect
    class type inspect ccp-h225ras-inspect
      inspect
    class type inspect ccp-h323nxg-inspect
      inspect
    class type inspect ccp-skinny-inspect
      inspect
    class class-default
      drop
    policy-map type inspect ccp-permit
    class type inspect SDM_DHCP_CLIENT_PT
      pass
    class type inspect ccp-sip-inspect
      pass
    class type inspect ccp-h323-inspect
      inspect
    class type inspect ccp-h323annexe-inspect
      inspect
    class type inspect ccp-h225ras-inspect
      inspect
    class type inspect ccp-h323nxg-inspect
      inspect
    class type inspect ccp-skinny-inspect
      inspect
    class class-default
      drop
    zone security in-zone
    zone security out-zone
    zone-pair security ccp-zp-out-self source out-zone destination self
    service-policy type inspect ccp-permit
    zone-pair security ccp-zp-in-out source in-zone destination out-zone
    service-policy type inspect ccp-inspect
    zone-pair security ccp-zp-self-out source self destination out-zone
    service-policy type inspect ccp-permit-icmpreply
    interface Null0
    no ip unreachables
    interface FastEthernet0/0
    description $ES_LAN$$FW_INSIDE$
    ip address 10.15.0.15 255.255.255.0
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    ip flow ingress
    ip nat inside
    ip virtual-reassembly in
    zone-member security in-zone
    duplex full
    speed auto
    no mop enabled
    interface FastEthernet0/1
    description $FW_OUTSIDE$$ETH-WAN$
    ip dhcp client update dns server none
    ip ddns update sdm_ddns1
    ip address dhcp client-id FastEthernet0/1 hostname bayross.net
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    ip nbar protocol-discovery
    ip flow ingress
    ip flow egress
    ip nat outside
    ip virtual-reassembly in
    zone-member security out-zone
    duplex auto
    speed auto
    no mop enabled
    service-policy output CCP-QoS-Policy-1
    interface FastEthernet0/2/0
    no ip address
    shutdown
    interface FastEthernet0/2/1
    no ip address
    shutdown
    interface FastEthernet0/2/2
    no ip address
    shutdown
    interface FastEthernet0/2/3
    no ip address
    shutdown
    interface Vlan1
    no ip address
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    ip flow ingress
    shutdown
    ip forward-protocol nd
    ip http server
    ip http access-class 2
    ip http authentication local
    ip http secure-server
    ip http path flash:
    ip flow-top-talkers
    top 10
    sort-by bytes
    cache-timeout 60000
    ip nat inside source list 1 interface FastEthernet0/1 overload
    ip access-list extended SDM_BOOTPC
    remark CCP_ACL Category=0
    permit udp any any eq bootpc
    logging trap debugging
    access-list 1 remark INSIDE_IF=FastEthernet0/0
    access-list 1 remark SDM_ACL Category=2
    access-list 1 permit 10.15.0.0 0.0.0.255
    access-list 2 remark HTTP Access-class list
    access-list 2 remark CCP_ACL Category=1
    access-list 2 permit 10.15.0.0 0.0.0.255
    access-list 2 deny   any
    access-list 100 remark CCP_ACL Category=128
    access-list 100 permit ip host 255.255.255.255 any
    access-list 100 permit ip 127.0.0.0 0.255.255.255 any
    no cdp run
    tftp-server flash:term41.default.loads alias term41.default.loads
    tftp-server flash:term61.default.loads alias term61.default.loads
    tftp-server flash:Analog1.raw
    tftp-server flash:Analog2.raw
    tftp-server flash:AreYouThere.raw
    tftp-server flash:AreYouThereF.raw
    tftp-server flash:Bass.raw
    tftp-server flash:CallBack.raw
    tftp-server flash:Chime.raw
    tftp-server flash:Classic1.raw
    tftp-server flash:Classic2.raw
    tftp-server flash:ClockShop.raw
    tftp-server flash:DistinctiveRingList.xml
    tftp-server flash:Drums1.raw
    tftp-server flash:Drums2.raw
    tftp-server flash:FilmScore.raw
    tftp-server flash:HarpSynth.raw
    tftp-server flash:Jamaica.raw
    tftp-server flash:KotoEffect.raw
    tftp-server flash:MusicBox.raw
    tftp-server flash:Piano1.raw
    tftp-server flash:Piano2.raw
    tftp-server flash:Pop.raw
    tftp-server flash:Pulse1.raw
    tftp-server flash:Ring1.raw
    tftp-server flash:Ring2.raw
    tftp-server flash:Ring3.raw
    tftp-server flash:Ring4.raw
    tftp-server flash:Ring5.raw
    tftp-server flash:Ring6.raw
    tftp-server flash:Ring7.raw
    tftp-server flash:RingList.xml
    tftp-server flash:Sax1.raw
    tftp-server flash:Sax2.raw
    tftp-server flash:Vibe.raw
    tftp-server flash:P00308010200.bin alias P00308010200.bin
    control-plane
    voice-port 0/1/0
    voice-port 0/1/1
    voice-port 0/1/2
    voice-port 0/1/3
    voice-port 0/3/0
    caller-id enable
    voice-port 0/3/1
    caller-id enable
    mgcp profile default
    sccp local FastEthernet0/0
    sccp ccm 10.15.0.15 identifier 1 version 4.0
    sccp
    sccp ccm group 1
    associate ccm 1 priority 1
    associate profile 2 register confprof2
    dspfarm profile 1 transcode
    codec g711ulaw
    codec g711alaw
    codec g729ar8
    codec g729abr8
    maximum sessions 20
    shutdown
    dspfarm profile 2 conference
    codec g711ulaw
    codec g711alaw
    maximum sessions 5
    associate application SCCP
    dial-peer cor custom
    name Main1_10Digit
    name Main1_11Digit
    dial-peer cor list Main1-11Digit
    member Main1_11Digit
    dial-peer cor list Main1-Line
    member Main1_10Digit
    member Main1_11Digit
    dial-peer voice 1 voip
    description ## INCOMING - DIDWW - 16472584731 ##
    session protocol sipv2
    session target sip-server
    session transport udp
    incoming called-number 16472584731
    dtmf-relay rtp-nte
    codec g711ulaw
    no vad
    dial-peer voice 2003 pots
    description #### INCOMING INTERFACE 0/3/1 ####
    destination-pattern 16472584731
    incoming called-number 16472584731
    port 0/3/1
    dial-peer voice 1000 pots
    description #### KITCHEN ####
    destination-pattern 1000
    port 0/3/0
    dial-peer voice 1003 pots
    description #### MASTER BEDROOM ####
    destination-pattern 1003
    port 0/3/1
    dial-peer voice 10 voip
    corlist outgoing Main1-11Digit
    description Main1 11-Digit Outgoing
    translation-profile outgoing LongDistance
    destination-pattern 91..........
    session protocol sipv2
    session target dns:sip.voipdiscount.com
    session transport udp
    dtmf-relay rtp-nte sip-notify
    codec g711ulaw
    no vad
    dial-peer voice 11 voip
    corlist outgoing Main1-Line
    translation-profile incoming Incoming
    translation-profile outgoing Local
    destination-pattern 9[^1]..[2-9]......
    session protocol sipv2
    session target dns:sip.fongo.com
    incoming called-number .
    dtmf-relay rtp-nte
    codec g711ulaw
    no vad
    dial-peer voice 12 voip
    translation-profile outgoing International
    destination-pattern 9011T
    session protocol sipv2
    session target dns:sip.voipdiscount.com
    dtmf-relay rtp-nte
    codec g711ulaw
    no vad
    dial-peer voice 911 voip
    translation-profile outgoing Emergency
    destination-pattern 111
    session protocol sipv2
    session target dns:sip.fongo.com
    dtmf-relay rtp-nte
    codec g711ulaw
    no vad
    gateway
    timer receive-rtp 1200
    sip-ua
    credentials username 37373737373 password 7 00000000000000000000 realm sip.fongo.com
    credentials username username password 7 00000000000000000000 realm sip.voipdiscount.com
    authentication username username password 7 0000000000000000000000000 realm sip.voipdiscount.com
    no remote-party-id
    srv version 1
    retry invite 3
    retry register 10
    timers register 150
    registrar 1 dns:sip.voipdiscount.com expires 3600
    registrar 2 dns:sip.fongo.com expires 3600
    sip-server dns:sip.voipdiscount.com
    host-registrar
    telephony-service
    sdspfarm units 1
    sdspfarm transcode sessions 5
    sdspfarm tag 1 confprof2
    conference hardware
    no auto-reg-ephone
    max-ephones 25
    max-dn 100
    ip source-address 10.15.0.15 port 2000
    system message Bayross Residence
    cnf-file location flash:
    user-locale US load CME-locale-en_US-English-7.0.1.1.tar
    load 7960-7940 P00308010200.loads
    load 7941 SCCP41.9-1-1SR1S.loads
    load 7941GE SCCP41.9-1-1SR1S.loads
    load 7961 SCCP41.9-1-1SR1S.loads
    load 7961GE SCCP41.9-1-1SR1S.loads
    time-zone 12
    max-conferences 8 gain -6
    moh flash:/music-on-hold.au
    web admin system name garrett secret 5 $1$MjiP$KMQoyqL/3mnftN0OLqs8b1
    time-webedit
    transfer-system full-consult
    secondary-dialtone 9
    create cnf-files version-stamp 7960 Oct 26 2012 19:53:22
    ephone-dn  2  octo-line
    number A001
    conference ad-hoc
    preference 3
    ephone-dn  3  octo-line
    number A002
    conference ad-hoc
    preference 3
    ephone-dn  4  octo-line
    number A003
    conference ad-hoc
    preference 3
    ephone-dn  5  octo-line
    number A004
    conference ad-hoc
    preference 3
    ephone-dn  6  octo-line
    number A005
    conference ad-hoc
    preference 3
    ephone-dn  11  dual-line
    number 1011 secondary 16472473297 no-reg both
    corlist incoming Main1-Line
    ephone-dn  12  dual-line
    number 1012
    label Garrett Bayross
    name Garrett Bayross
    corlist incoming Main1-Line
    ephone  1
    no multicast-moh
    device-security-mode none
    mac-address F04D.A28C.CBAC
    mtp
    type CIPC
    button  1:11
    ephone  2
    device-security-mode none
    mac-address 0016.4697.A472
    type 7940
    button  1:12
    banner login ^CBayross.NET Network
    ^C
    banner motd ^C
    line con 0
    logging synchronous
    line aux 0
    line vty 0 4
    login local
    transport input all
    transport output all
    scheduler allocate 20000 1000
    ntp update-calendar
    ntp server 128.100.100.128 prefer source FastEthernet0/1
    end

    DEBUG OUTPUT:
    login as: garrett
    Bayross.NET Network
    Using keyboard-interactive authentication.
    Password:
    ------------- LEGAL NOTICE ----------------
    --      THIS IS A PRIVATE SYSTEM         --
    --  UNAUTHORIZED ACCESS IS PROHIBITED    --
    --      CECI EST UN SYSTEME PRIVE        --
    --  TOUT ACCES NON AUTORISE EST INTERDIT --
    BNET01C2811-TOR1807#deb
    BNET01C2811-TOR1807#debug ccsip all
    This may severely impact system performance. Continue? [confirm]
    All SIP Call tracing is enabled
    BNET01C2811-TOR1807#term mon
    BNET01C2811-TOR1807#REGISTER sip:sip.voipdiscount.com:5060 SIP/2.0
    Via: SIP/2.0/UDP 99.230.172.76:5060;branch=z9hG4bKED020B5
    From: [email protected]>;tag=59BB550-3A6
    To: [email protected]>
    Date: Sun, 28 Oct 2012 00:51:43 GMT
    Call-ID: C977B084-1FCE11E2-81A4A3AB-85AB6D24
    User-Agent: Cisco-SIPGateway/IOS-12.x
    Max-Forwards: 70
    Timestamp: 1351385503
    CSeq: 5 REGISTER
    Contact:
    Expires:  3600
    Supported: path
    Content-Length: 0
    1859402: Oct 27 21:51:47.834 EDT: //-1/xxxxxxxxxxxx/SIP/Info/sipSPISetDateHeader: Converting TimeZone EDT to SIP default timezone = GMT
    1859403: Oct 27 21:51:47.834 EDT: //3542/000000000000/SIP/Info/sipSPISendRegister: Associated container=0x4E3C18B0 to Register
    1859404: Oct 27 21:51:47.834 EDT: //3542/000000000000/SIP/Transport/sipSPISendRegister: Sending REGISTER to the transport layer
    1859405: Oct 27 21:51:47.834 EDT: //3542/000000000000/SIP/Transport/sipSPIGetSwitchTransportFlag: Return the Global configuration, Switch Transport is FALSE
    1859406: Oct 27 21:51:47.834 EDT: //3542/000000000000/SIP/Transport/sipSPITransportSendMessage: msg=0x4CCD8DC8, addr=77.72.169.134, port=5060, sentBy_port=0, local_addr=, is_req=1, transport=1, switch=0, callBack=0x0
    1859407: Oct 27 21:51:47.834 EDT: //3542/000000000000/SIP/Transport/sipSPITransportSendMessage: Proceedable for sending msg immediately
    1859408: Oct 27 21:51:47.834 EDT: //3542/000000000000/SIP/Transport/sipTransportLogicSendMsg: switch transport is 0
    1859409: Oct 27 21:51:47.834 EDT: //-1/xxxxxxxxxxxx/SIP/Transport/sipConnectionManagerGetConnection: connection required for raddr:77.72.169.134, rport:5060 with laddr:
    1859410: Oct 27 21:51:47.834 EDT: //3542/000000000000/SIP/Transport/sipTransportLogicSendMsg: Set to send the msg=0x4CCD8DC8
    1859411: Oct 27 21:51:47.834 EDT: //-1/xxxxxxxxxxxx/SIP/Transport/sipTransportPostSendMessage: Posting send for msg=0x4CCD8DC8, addr=77.72.169.134, port=5060, local_addr=, connId=4 for UDP
    1859412: Oct 27 21:51:47.838 EDT: //-1/xxxxxxxxxxxx/SIP/Msg/ccsipDisplayMsg:
    Sent:
    REGISTER sip:sip.voipdiscount.com:5060 SIP/2.0
    Via: SIP/2.0/UDP 99.230.172.76:5060;branch=z9hG4bKED020B5
    From: [email protected]>;tag=59BB550-3A6
    To: [email protected]>
    Date: Sun, 28 Oct 2012 00:51:47 GMT
    Call-ID: C977B084-1FCE11E2-81A4A3AB-85AB6D24
    User-Agent: Cisco-SIPGateway/IOS-12.x
    Max-Forwards: 70
    Timestamp: 1351385507
    CSeq: 5 REGISTER
    Contact:
    Expires:  3600
    Supported: path
    Content-Length: 0
    1859413: Oct 27 21:51:51.834 EDT: //-1/xxxxxxxxxxxx/SIP/Info/sipSPISetDateHeader: Converting TimeZone EDT to SIP default timezone = GMT
    1859414: Oct 27 21:51:51.834 EDT: //3542/000000000000/SIP/Info/sipSPISendRegister: Associated container=0x4E3C18B0 to Register
    1859415: Oct 27 21:51:51.834 EDT: //3542/000000000000/SIP/Transport/sipSPISendRegister: Sending REGISTER to the transport layer
    1859416: Oct 27 21:51:51.834 EDT: //3542/000000000000/SIP/Transport/sipSPIGetSwitchTransportFlag: Return the Global configuration, Switch Transport is FALSE
    1859417: Oct 27 21:51:51.834 EDT: //3542/000000000000/SIP/Transport/sipSPITransportSendMessage: msg=0x4CCD8DC8, addr=77.72.169.134, port=5060, sentBy_port=0, local_addr=, is_req=1, transport=1, switch=0, callBack=0x0
    1859418: Oct 27 21:51:51.834 EDT: //3542/000000000000/SIP/Transport/sipSPITransportSendMessage: Proceedable for sending msg immediately
    1859419: Oct 27 21:51:51.838 EDT: //3542/000000000000/SIP/Transport/sipTransportLogicSendMsg: switch transport is 0
    1859420: Oct 27 21:51:51.838 EDT: //-1/xxxxxxxxxxxx/SIP/Transport/sipConnectionManagerGetConnection: connection required for raddr:77.72.169.134, rport:5060 with laddr:
    1859421: Oct 27 21:51:51.838 EDT: //3542/000000000000/SIP/Transport/sipTransportLogicSendMsg: Set to send the msg=0x4CCD8DC8
    1859422: Oct 27 21:51:51.838 EDT: //-1/xxxxxxxxxxxx/SIP/Transport/sipTransportPostSendMessage: Posting send for msg=0x4CCD8DC8, addr=77.72.169.134, port=5060, local_addr=, connId=4 for UDP
    1859423: Oct 27 21:51:51.842 EDT: //-1/xxxxxxxxxxxx/SIP/Msg/ccsipDisplayMsg:
    Sent:
    REGISTER sip:sip.voipdiscount.com:5060 SIP/2.0
    Via: SIP/2.0/UDP 99.230.172.76:5060;branch=z9hG4bKED020B5
    From: [email protected]>;tag=59BB550-3A6
    To: [email protected]>
    Date: Sun, 28 Oct 2012 00:51:51 GMT
    Call-ID: C977B084-1FCE11E2-81A4A3AB-85AB6D24
    User-Agent: Cisco-SIPGateway/IOS-12.x
    Max-Forwards: 70
    Timestamp: 1351385511
    CSeq: 5 REGISTER
    Contact:
    Expires:  3600
    Supported: path
    Content-Length: 0
    1859424: Oct 27 21:51:55.834 EDT: //-1/xxxxxxxxxxxx/SIP/Info/sipSPISetDateHeader: Converting TimeZone EDT to SIP default timezone = GMT
    1859425: Oct 27 21:51:55.834 EDT: //3542/000000000000/SIP/Info/sipSPISendRegister: Associated container=0x4E3C18B0 to Register
    1859426: Oct 27 21:51:55.834 EDT: //3542/000000000000/SIP/Transport/sipSPISendRegister: Sending REGISTER to the transport layer
    1859427: Oct 27 21:51:55.834 EDT: //3542/000000000000/SIP/Transport/sipSPIGetSwitchTransportFlag: Return the Global configuration, Switch Transport is FALSE
    1859428: Oct 27 21:51:55.834 EDT: //3542/000000000000/SIP/Transport/sipSPITransportSendMessage: msg=0x4CCD8DC8, addr=77.72.169.134, port=5060, sentBy_port=0, local_addr=, is_req=1, transport=1, switch=0, callBack=0x0
    1859429: Oct 27 21:51:55.834 EDT: //3542/000000000000/SIP/Transport/sipSPITransportSendMessage: Proceedable for sending msg immediately
    1859430: Oct 27 21:51:55.834 EDT: //3542/000000000000/SIP/Transport/sipTransportLogicSendMsg: switch transport is 0
    1859431: Oct 27 21:51:55.834 EDT: //-1/xxxxxxxxxxxx/SIP/Transport/sipConnectionManagerGetConnection: connection required for raddr:77.72.169.134, rport:5060 with laddr:
    1859432: Oct 27 21:51:55.834 EDT: //3542/000000000000/SIP/Transport/sipTransportLogicSendMsg: Set to send the msg=0x4CCD8DC8
    1859433: Oct 27 21:51:55.834 EDT: //-1/xxxxxxxxxxxx/SIP/Transport/sipTransportPostSendMessage: Posting send for msg=0x4CCD8DC8, addr=77.72.169.134, port=5060, local_addr=, connId=4 for UDP
    1859434: Oct 27 21:51:55.838 EDT: //-1/xxxxxxxxxxxx/SIP/Msg/ccsipDisplayMsg:
    Sent:
    REGISTER sip:sip.voipdiscount.com:5060 SIP/2.0
    Via: SIP/2.0/UDP 99.230.172.76:5060;branch=z9hG4bKED020B5
    From: [email protected]>;tag=59BB550-3A6
    To: [email protected]>
    Date: Sun, 28 Oct 2012 00:51:55 GMT
    Call-ID: C977B084-1FCE11E2-81A4A3AB-85AB6D24
    User-Agent: Cisco-SIPGateway/IOS-12.x
    Max-Forwards: 70
    Timestamp: 1351385515
    CSeq: 5 REGISTER
    Contact:
    Expires:  3600
    Supported: path
    Content-Length: 0
    1859435: Oct 27 21:51:59.834 EDT: //-1/xxxxxxxxxxxx/SIP/Info/resolve_sig_ip_address_to_bind: calling reg_invoke_ip_first_hop()
    1859436: Oct 27 21:51:59.834 EDT: //-1/xxxxxxxxxxxx/SIP/Info/resolve_sig_ip_address_to_bind: calling ip_best_local_address()
    1859437: Oct 27 21:51:59.834 EDT: //-1/xxxxxxxxxxxx/SIP/Info/resolve_sig_ip_address_to_bind: return addr 99.230.172.76
    1859438: Oct 27 21:51:59.834 EDT: //-1/xxxxxxxxxxxx/SIP/Info/resolve_sig_ip_address_to_bind: calling reg_invoke_ip_first_hop()
    1859439: Oct 27 21:51:59.834 EDT: //-1/xxxxxxxxxxxx/SIP/Info/resolve_sig_ip_address_to_bind: calling ip_best_local_address()
    1859440: Oct 27 21:51:59.834 EDT: //-1/xxxxxxxxxxxx/SIP/Info/resolve_sig_ip_address_to_bind: return addr 99.230.172.76
    1859441: Oct 27 21:51:59.834 EDT: //-1/xxxxxxxxxxxx/SIP/Info/ccsip_spi_register_get_rcb: Getting New RCB [0x4C6D2730]
    1859442: Oct 27 21:51:59.834 EDT: //-1/xxxxxxxxxxxx/SIP/Info/ccsipGetCCBFromRCB: Retrived CCB pointer [0x0]
    1859443: Oct 27 21:51:59.834 EDT: //-1/xxxxxxxxxxxx/SIP/Info/ccsip_spi_register_free_rcb: Freeing rcb [0x4C6D1BAC]
    1859444: Oct 27 21:51:59.834 EDT: //-1/xxxxxxxxxxxx/SIP/Info/ccsip_register_set_dns_resolved_address: CCSIP_REGISTER:: registrar 0 DNS resolved addr set to 77.72.169.131:5060
    1859445: Oct 27 21:51:59.834 EDT: //-1/xxxxxxxxxxxx/SIP/Info/ccsipRegisterStartRCBTimer: Starting timer for pattern  for 3600 seconds
    1859446: Oct 27 21:51:59.834 EDT: //-1/xxxxxxxxxxxx/SIP/Info/sipSPISetDateHeader: Converting TimeZone EDT to SIP default timezone = GMT
    1859447: Oct 27 21:51:59.838 EDT: //3542/000000000000/SIP/Info/sipSPISendRegister: Associated container=0x4E3C18B0 to Register
    1859448: Oct 27 21:51:59.838 EDT: //3542/000000000000/SIP/Transport/sipSPISendRegister: Sending REGISTER to the transport layer
    1859449: Oct 27 21:51:59.838 EDT: //3542/000000000000/SIP/Transport/sipSPIGetSwitchTransportFlag: Return the Global configuration, Switch Transport is FALSE
    1859450: Oct 27 21:51:59.838 EDT: //3542/000000000000/SIP/Transport/sipSPITransportSendMessage: msg=0x4CCD8DC8, addr=77.72.169.131, port=5060, sentBy_port=0, local_addr=, is_req=1, transport=1, switch=0, callBack=0x41C25300
    1859451: Oct 27 21:51:59.838 EDT: //3542/000000000000/SIP/Transport/sipSPITransportSendMessage: Proceedable for sending msg immediately
    1859452: Oct 27 21:51:59.838 EDT: //3542/000000000000/SIP/Transport/sipTransportLogicSendMsg: switch transport is 0
    1859453: Oct 27 21:51:59.838 EDT: //-1/xxxxxxxxxxxx/SIP/Transport/sipConnectionManagerGetConnection: connection required for raddr:77.72.169.131, rport:5060 with laddr:
    1859454: Oct 27 21:51:59.838 EDT: //3542/000000000000/SIP/Transport/sipTransportLogicSendMsg: Set to send the msg=0x4CCD8DC8
    1859455: Oct 27 21:51:59.838 EDT: //-1/xxxxxxxxxxxx/SIP/Transport/sipTransportPostSendMessage: Posting send for msg=0x4CCD8DC8, addr=77.72.169.131, port=5060, local_addr=, connId=2 for UDP
    1859456: Oct 27 21:51:59.842 EDT: //3542/000000000000/SIP/State/sipSPIChangeState: 0x4B6533C0 : State change from (SIP_STATE_OUTGOING_REGISTER, SUBSTATE_NONE)  to (SIP_STATE_OUTGOING_REGISTER, SUBSTATE_NONE)
    1859457: Oct 27 21:51:59.846 EDT: //-1/xxxxxxxxxxxx/SIP/Msg/ccsipDisplayMsg:
    Sent:
    REGISTER sip:sip.voipdiscount.com:5060 SIP/2.0
    Via: SIP/2.0/UDP 99.230.172.76:5060;branch=z9hG4bKED020B5
    From: [email protected]>;tag=59BB550-3A6
    To: [email protected]>
    Date: Sun, 28 Oct 2012 00:51:59 GMT
    Call-ID: C977B084-1FCE11E2-81A4A3AB-85AB6D24
    User-Agent: Cisco-SIPGateway/IOS-12.x
    Max-Forwards: 70
    Timestamp: 1351385519
    CSeq: 5 REGISTER
    Contact:
    Expires:  3600
    Supported: path
    Content-Length: 0
    1859458: Oct 27 21:51:59.990 EDT: //-1/xxxxxxxxxxxx/SIP/Info/sipSPISetDateHeader: Converting TimeZone EDT to SIP default timezone = GMT
    1859459: Oct 27 21:51:59.990 EDT: //3542/000000000000/SIP/Info/sipSPISendRegister: Associated container=0x4E3C18B0 to Register
    1859460: Oct 27 21:51:59.990 EDT: //3542/000000000000/SIP/Transport/sipSPISendRegister: Sending REGISTER to the transport layer
    1859461: Oct 27 21:51:59.990 EDT: //3542/000000000000/SIP/Transport/sipSPIGetSwitchTransportFlag: Return the Global configuration, Switch Transport is FALSE
    1859462: Oct 27 21:51:59.990 EDT: //3542/000000000000/SIP/Transport/sipSPITransportSendMessage: msg=0x4CCD8DC8, addr=77.72.169.131, port=5060, sentBy_port=0, local_addr=, is_req=1, transport=1, switch=0, callBack=0x0
    1859463: Oct 27 21:51:59.990 EDT: //3542/000000000000/SIP/Transport/sipSPITransportSendMessage: Proceedable for sending msg immediately
    1859464: Oct 27 21:51:59.990 EDT: //3542/000000000000/SIP/Transport/sipTransportLogicSendMsg: switch transport is 0
    1859465: Oct 27 21:51:59.990 EDT: //-1/xxxxxxxxxxxx/SIP/Transport/sipConnectionManagerGetConnection: connection required for raddr:77.72.169.131, rport:5060 with laddr:
    1859466: Oct 27 21:51:59.990 EDT: //3542/000000000000/SIP/Transport/sipTransportLogicSendMsg: Set to send the msg=0x4CCD8DC8
    1859467: Oct 27 21:51:59.990 EDT: //-1/xxxxxxxxxxxx/SIP/Transport/sipTransportPostSendMessage: Posting send for msg=0x4CCD8DC8, addr=77.72.169.131, port=5060, local_addr=, connId=2 for UDP
    1859468: Oct 27 21:51:59.994 EDT: //-1/xxxxxxxxxxxx/SIP/Msg/ccsipDisplayMsg:
    Sent:
    REGISTER sip:sip.voipdiscount.com:5060 SIP/2.0
    Via: SIP/2.0/UDP 99.230.172.76:5060;branch=z9hG4bKED020B5
    From: [email protected]>;tag=59BB550-3A6
    To: [email protected]>
    Date: Sun, 28 Oct 2012 00:51:59 GMT
    Call-ID: C977B084-1FCE11E2-81A4A3AB-85AB6D24
    User-Agent: Cisco-SIPGateway/IOS-12.x
    Max-Forwards: 70
    Timestamp: 1351385519
    CSeq: 5 REGISTER
    Contact:
    Expires:  3600
    Supported: path
    Content-Length: 0
    1859469: Oct 27 21:52:00.290 EDT: //-1/xxxxxxxxxxxx/SIP/Info/sipSPISetDateHeader: Converting TimeZone EDT to SIP default timezone = GMT
    1859470: Oct 27 21:52:00.290 EDT: //3542/000000000000/SIP/Info/sipSPISendRegister: Associated container=0x4E3C18B0 to Register
    1859471: Oct 27 21:52:00.290 EDT: //3542/000000000000/SIP/Transport/sipSPISendRegister: Sending REGISTER to the transport layer
    1859472: Oct 27 21:52:00.290 EDT: //3542/000000000000/SIP/Transport/sipSPIGetSwitchTransportFlag: Return the Global configuration, Switch Transport is FALSE
    1859473: Oct 27 21:52:00.290 EDT: //3542/000000000000/SIP/Transport/sipSPITransportSendMessage: msg=0x4CCD8DC8, addr=77.72.169.131, port=5060, sentBy_port=0, local_addr=, is_req=1, transport=1, switch=0, callBack=0x0
    1859474: Oct 27 21:52:00.290 EDT: //3542/000000000000/SIP/Transport/sipSPITransportSendMessage: Proceedable for sending msg immediately
    1859475: Oct 27 21:52:00.294 EDT: //3542/000000000000/SIP/Transport/sipTransportLogicSendMsg: switch transport is 0
    1859476: Oct 27 21:52:00.294 EDT: //-1/xxxxxxxxxxxx/SIP/Transport/sipConnectionManagerGetConnection: connection required for raddr:77.72.169.131, rport:5060 with laddr:
    1859477: Oct 27 21:52:00.294 EDT: //3542/000000000000/SIP/Transport/sipTransportLogicSendMsg: Set to send the msg=0x4CCD8DC8
    1859478: Oct 27 21:52:00.294 EDT: //-1/xxxxxxxxxxxx/SIP/Transport/sipTransportPostSendMessage: Posting send for msg=0x4CCD8DC8, addr=77.72.169.131, port=5060, local_addr=, connId=2 for UDP
    1859479: Oct 27 21:52:00.294 EDT: //-1/xxxxxxxxxxxx/SIP/Msg/ccsipDisplayMsg:
    Sent:
    REGISTER sip:sip.voipdiscount.com:5060 SIP/2.0
    Via: SIP/2.0/UDP 99.230.172.76:5060;branch=z9hG4bKED020B5
    From: [email protected]>;tag=59BB550-3A6
    To: [email protected]>
    Date: Sun, 28 Oct 2012 00:52:00 GMT
    Call-ID: C977B084-1FCE11E2-81A4A3AB-85AB6D24
    User-Agent: Cisco-SIPGateway/IOS-12.x
    Max-Forwards: 70
    Timestamp: 1351385520
    CSeq: 5 REGISTER
    Contact:
    Expires:  3600
    Supported: path
    Content-Length: 0
    1859480: Oct 27 21:52:00.891 EDT: //-1/xxxxxxxxxxxx/SIP/Info/sipSPISetDateHeader: Converting TimeZone EDT to SIP default timezone = GMT
    1859481: Oct 27 21:52:00.891 EDT: //3542/000000000000/SIP/Info/sipSPISendRegister: Associated container=0x4E3C18B0 to Register
    1859482: Oct 27 21:52:00.891 EDT: //3542/000000000000/SIP/Transport/sipSPISendRegister: Sending REGISTER to the transport layer
    1859483: Oct 27 21:52:00.891 EDT: //3542/000000000000/SIP/Transport/sipSPIGetSwitchTransportFlag: Return the Global configuration, Switch Transport is FALSE
    1859484: Oct 27 21:52:00.891 EDT: //3542/000000000000/SIP/Transport/sipSPITransportSendMessage: msg=0x4CCD8DC8, addr=77.72.169.131, port=5060, sentBy_port=0, local_addr=, is_req=1, transport=1, switch=0, callBack=0x0
    1859485: Oct 27 21:52:00.891 EDT: //3542/000000000000/SIP/Transport/sipSPITransportSendMessage: Proceedable for sending msg immediately
    1859486: Oct 27 21:52:00.891 EDT: //3542/000000000000/SIP/Transport/sipTransportLogicSendMsg: switch transport is 0
    1859487: Oct 27 21:52:00.891 EDT: //-1/xxxxxxxxxxxx/SIP/Transport/sipConnectionManagerGetConnection: connection required for raddr:77.72.169.131, rport:5060 with laddr:
    1859488: Oct 27 21:52:00.891 EDT: //3542/000000000000/SIP/Transport/sipTransportLogicSendMsg: Set to send the msg=0x4CCD8DC8
    1859489: Oct 27 21:52:00.891 EDT: //-1/xxxxxxxxxxxx/SIP/Transport/sipTransportPostSendMessage: Posting send for msg=0x4CCD8DC8, addr=77.72.169.131, port=5060, local_addr=, connId=2 for UDP
    1859490: Oct 27 21:52:00.899 EDT: //-1/xxxxxxxxxxxx/SIP/Msg/ccsipDisplayMsg:
    Sent:
    REGISTER sip:sip.voipdiscount.com:5060 SIP/2.0
    Via: SIP/2.0/UDP 99.230.172.76:5060;branch=z9hG4bKED020B5
    From: [email protected]>;tag=59BB550-3A6
    To: [email protected]>
    Date: Sun, 28 Oct 2012 00:52:00 GMT
    Call-ID: C977B084-1FCE11E2-81A4A3AB-85AB6D24
    User-Agent: Cisco-SIPGateway/IOS-12.x
    Max-Forwards: 70
    Timestamp: 1351385520
    CSeq: 5 REGISTER
    Contact:
    Expires:  3600
    Supported: path
    Content-Length: 0
    1859491: Oct 27 21:52:02.091 EDT: //-1/xxxxxxxxxxxx/SIP/Info/sipSPISetDateHeader: Converting TimeZone EDT to SIP default timezone = GMT
    1859492: Oct 27 21:52:02.091 EDT: //3542/000000000000/SIP/Info/sipSPISendRegister: Associated container=0x4E3C18B0 to Register
    1859493: Oct 27 21:52:02.091 EDT: //3542/000000000000/SIP/Transport/sipSPISendRegister: Sending REGISTER to the transport layer
    1859494: Oct 27 21:52:02.091 EDT: //3542/000000000000/SIP/Transport/sipSPIGetSwitchTransportFlag: Return the Global configuration, Switch Transport is FALSE
    1859495: Oct 27 21:52:02.091 EDT: //3542/000000000000/SIP/Transport/sipSPITransportSendMessage: msg=0x4CCD8DC8, addr=77.72.169.131, port=5060, sentBy_port=0, local_addr=, is_req=1, transport=1, switch=0, callBack=0x0
    1859496: Oct 27 21:52:02.091 EDT: //3542/000000000000/SIP/Transport/sipSPITransportSendMessage: Proceedable for sending msg immediately
    1859497: Oct 27 21:52:02.091 EDT: //3542/000000000000/SIP/Transport/sipTransportLogicSendMsg: switch transport is 0
    1859498: Oct 27 21:52:02.091 EDT: //-1/xxxxxxxxxxxx/SIP/Transport/sipConnectionManagerGetConnection: connection required for raddr:77.72.169.131, rport:5060 with laddr:
    1859499: Oct 27 21:52:02.091 EDT: //3542/000000000000/SIP/Transport/sipTransportLogicSendMsg: Set to send the msg=0x4CCD8DC8
    1859500: Oct 27 21:52:02.091 EDT: //-1/xxxxxxxxxxxx/SIP/Transport/sipTransportPostSendMessage: Posting send for msg=0x4CCD8DC8, addr=77.72.169.131, port=5060, local_addr=, connId=2 for UDP
    1859501: Oct 27 21:52:02.099 EDT: //-1/xxxxxxxxxxxx/SIP/Msg/ccsipDisplayMsg:
    Sent:
    REGISTER sip:sip.voipdiscount.com:5060 SIP/2.0
    Via: SIP/2.0/UDP 99.230.172.76:5060;branch=z9hG4bKED020B5
    From: [email protected]>;tag=59BB550-3A6
    To: [email protected]>
    Date: Sun, 28 Oct 2012 00:52:02 GMT
    Call-ID: C977B084-1FCE11E2-81A4A3AB-85AB6D24
    User-Agent: Cisco-SIPGateway/IOS-12.x
    Max-Forwards: 70
    Timestamp: 1351385522
    CSeq: 5 REGISTER
    Contact:
    Expires:  3600
    Supported: path
    Content-Length: 0
    1859502: Oct 27 21:52:04.491 EDT: //-1/xxxxxxxxxxxx/SIP/Info/sipSPISetDateHeader: Converting TimeZone EDT to SIP default timezone = GMT
    1859503: Oct 27 21:52:04.491 EDT: //3542/000000000000/SIP/Info/sipSPISendRegister: Associated container=0x4E3C18B0 to Register
    1859504: Oct 27 21:52:04.491 EDT: //3542/000000000000/SIP/Transport/sipSPISendRegister: Sending REGISTER to the transport layer
    1859505: Oct 27 21:52:04.491 EDT: //3542/000000000000/SIP/Transport/sipSPIGetSwitchTransportFlag: Return the Global configuration, Switch Transport is FALSE
    1859506: Oct 27 21:52:04.491 EDT: //3542/000000000000/SIP/Transport/sipSPITransportSendMessage: msg=0x4CCD8DC8, addr=77.72.169.131, port=5060, sentBy_port=0, local_addr=, is_req=1, transport=1, switch=0, callBack=0x0
    1859507: Oct 27 21:52:04.491 EDT: //3542/000000000000/SIP/Transport/sipSPITransportSendMessage: Proceedable for sending msg immediately
    1859508: Oct 27 21:52:04.491 EDT: //3542/000000000000/SIP/Transport/sipTransportLogicSendMsg: switch transport is 0
    1859509: Oct 27 21:52:04.491 EDT: //-1/xxxxxxxxxxxx/SIP/Transport/sipConnectionManagerGetConnection: connection required for raddr:77.72.169.131, rport:5060 with laddr:
    1859510: Oct 27 21:52:04.491 EDT: //3542/000000000000/SIP/Transport/sipTransportLogicSendMsg: Set to send the msg=0x4CCD8DC8
    1859511: Oct 27 21:52:04.491 EDT: //-1/xxxxxxxxxxxx/SIP/Transport/sipTransportPostSendMessage: Posting send for msg=0x4CCD8DC8, addr=77.72.169.131, port=5060, local_addr=, connId=2 for UDP
    1859512: Oct 27 21:52:04.495 EDT: //-1/xxxxxxxxxxxx/SIP/Msg/ccsipDisplayMsg:
    Sent:

  • QoS Trust

    Hi,
    I just want to confirm the best practice with CUCM and LAN QoS. I have a CUCM 10.5 cluster attached to a 4948 edge. CUCM is marking all signalling traffic with the appropriate DSCP markings. Therefore I assume all that is required on the LAN is to trust the QoS/DSCP markings?
    An example edge port with AutoQoS to a CUCM Subscriber:
    *The key command being  'auto qos voip trust'
    *This switch port is connected to a UCS C-Series
    SWITCH#sh run int Gig 1/47
    Building configuration...
    Current configuration : 285 bytes
    interface GigabitEthernet1/47
    description CUCM_SUB
    switchport trunk encapsulation dot1q
    switchport mode trunk
    media-type rj45
    qos trust cos
    auto qos voip trust
    tx-queue 3
    bandwidth percent 33
    priority high
    shape percent 33
    service-policy output autoqos-voip-policy
    end
    All uplinks in the LAN also have the same ' auto qos voip trust' command set. So we should have 'end to end' QoS in the LAN?
    Edge ports to IP Phones are set as 'auto qos voip cisco-phone'.
    Thanks!
    Dean

    Thanks you for your response.
    Yes you’re right there, but the problem is that if an incoming packed has a dscp value 0 (not marked) than it should be remarked and only then. Therefore I need the trust dscp command as shown in the IOS CLI configuration segment I posted, otherwise the incoming packed is remarked no matter what dscp value it has. I didn’t find another way yet to solve this without the trust dscp command.

  • QoS probleme

    Hi everyone,
    I've got a probleme. I red the cisco QoS book, but it doesn't work for me.
    I want to do what so many others do, reserve bandwitdh for some specific trafic. But if I test the config, every flow gets the same bandwidth.
    I transmit from 2 pc's with a matching ip and a not matching ip each 100MB file. Teracopy shows me the bandwitdh of each 1,3 MB/s and if I look to the folder, the files arrive nearly at the same time. 
    IOS (tm) C2600 Software (C2600-I-M), Version 12.2(19), RELEASE SOFTWARE (fc3)
    Standard IP access list it-intern
        permit x.x.x.x (125133 matches)
        permit x.x.x.x (60651 matches)
        permit x.x.x.x, wildcard bits 0.0.0.255 (905968 matches)
    Class Map match-any class-default (id 0)
       Match any
    Class Map match-any not-it-intern (id 1)
       Match not access-group name it-intern
      Policy Map cbwfq
        Class not-it-intern
          Bandwidth 70 (%) Max Threshold 64 (packets)
    interface FastEthernet0/1
    description # 20 MBit #
    bandwidth 20000
    ip address x.x.x.x x.x.x.x
    service-policy output cbwfq
    ip route-cache flow
    no ip mroute-cache
    duplex auto
    speed auto
    If I make:
    ciscoHV3#sh pol int
    FastEthernet0/1
      Service-policy output: cbwfq
        Class-map: not-it-intern (match-any)
          11127978 packets, 4292340182 bytes
          5 minute offered rate 4422000 bps, drop rate 0 bps
          Match: not access-group name it-intern
            11127962 packets, 4292327891 bytes
            5 minute rate 4422000 bps
          Queueing
            Output Queue: Conversation 265
            Bandwidth 70 (%) Max Threshold 64 (packets)
            (pkts matched/bytes matched) 111155/27836979
            (depth/total drops/no-buffer drops) 0/0/0
        Class-map: class-default (match-any)
          827815 packets, 919625061 bytes
          5 minute offered rate 2911000 bps, drop rate 0 bps
          Match: any
    - I can see that pakets became matched.
    I fall in dispair, please help.

    I've got a WAN connection, which is connected via FastEthernet to the router. The ISP garantees 20 mbit/s. There are 2 IPs and 1 Subnet that got low prior. So I created a Class that "Not" matches that Accessgroup. The remaining traffic should become a minimum of 70% of the bandwidth.
    If I understand you, I only get congestion if i would use the physical interface speed (100mbit/s) and only in this case I can use the bandwidth comands.
    But would work a config like this?:
    Policy-Map cbwfq
        Class not-it-intern
          Bandwidth percent 70
    Policy-Map police-all
        Class class-default
          police cir 20000000
          service-policy cbwfq
    interface FastEthernet0/1
    description # 20 MBit #
    bandwidth 20000
    ip address x.x.x.x x.x.x.x
    service-policy output police-all
    ip route-cache flow
    no ip mroute-cache
    duplex auto
    speed auto
    I don't want to use shaping, thats the currently way how I limit the traffic for the sources of the ACL(it-intern). But shaping stresses the router a little bit too much and how I said, I dont want to limit I want to garantee a minimum of traffic.
    By the way, thanks a lot for your help until now.

  • Question on QOS Configuration

    I am classifying traffic using NBAR and Access-lists, setting DSCP values, and then useing bandwidth percentages to reserve bandwidth for protected classes in times of high utilization.
    I currently have this setup on my outside interface (connecting to PE) and have the service policy set on output (egress).
    I have found that large data transfers of default-class traffic is still able to overwhelm the link and the resereved bandwidth percentages to not seem to be able to protect the data in those classes.
    Question 1 - Is it common configuration to classify, mark, and set queing policies on the same interface? Or should I be classifying and marking on the ingress of the LAN interface and then apply the queing on the outside interafce egress?
    Here is my current config. As you can see, I am classifying the traffic ussing access lists and NBAR, and then I am using the policy map on my outside (PE connnected) interface egress. For brevity, I have not included the contents of the access-lists. Does anyone see any issues with this config?
    class-map match-all AF41
    match access-group name Management
    class-map match-all AF21
    match access-group name Priority-Apps
    class-map match-all AF31
    match access-group name Critical-Apps
    match protocol citrix
    match protocol kerberos
    match protocol ldap
    policy-map SETDSCP-KABI-NA
    class AF41
      bandwidth percent 20
      random-detect dscp-based
      set ip dscp af41
    class AF31
      bandwidth percent 25
      random-detect dscp-based
      set ip dscp af31
    class AF21
      bandwidth percent 25
      random-detect dscp-based
      set ip dscp af21
      class class-default
      set ip dscp default
      fair-queue
    interface Multilink1
    service-policy output SETDSCP-KABI-NA
    Thanks in advance for your replies..

    Disclaimer
    The  Author of this posting offers the information contained within this  posting without consideration and with the reader's understanding that  there's no implied or expressed suitability or fitness for any purpose.  Information provided is for informational purposes only and should not  be construed as rendering professional advice of any kind. Usage of this  posting's information is solely at reader's own risk.
    Liability Disclaimer
    In  no event shall Author be liable for any damages whatsoever (including,  without limitation, damages for loss of use, data or profit) arising out  of the use or inability to use the posting's information even if Author  has been advised of the possibility of such damage.
    Posting
    Question 1 - Is it common configuration to classify, mark, and set queing policies on the same interface? Or should I be classifying and marking on the ingress of the LAN interface and then apply the queing on the outside interafce egress?
    I don't know how common one technique is vs. the other, as QoS is still a bit uncommon, but if possible, I personally prefer doing everything in the egress policy.
    Does anyone see any issues with this config?
    I normally recommend against using RED unless you really understand the technology.  I would especially question using RED and FQ in the same class, as you do in class AF21.
    I currently have this setup on my outside interface (connecting to PE) and have the service policy set on output (egress). I have found that large data transfers of default-class traffic is still able to overwhelm the link and the resereved bandwidth percentages to not seem to be able to protect the data in those classes.
    You describe connecting to a PE, so this is not a p2p link?  If you're working across some kind of cloud technology, just setting QoS, even correctly, on the egress to cloud interface might be insufficient.  Might you describe your WAN environment?
    As you mention default-class traffic, but you didn't post a default-class, you're just using the implicit default settings for this class?
    As you're using NBAR and FQ in a named class, I assume you're working with a software based router using post HQF QoS, but identification of the actual platform and IOS version being used, might also be helpful.

Maybe you are looking for

  • OS X 10.10.2 Server 4.0.3 Wiki User Login Issue

    I have an Apple wiki that seems to be running fine for all but one user. Now, when that user tries to login it just sits there and does not process the username or password. When you go to All People that user is no longer listed there. We authentica

  • Standard transaction for PO Reporting

    Hi all, I'm on SRM 5.0 ECS. I'm looking for some standard transactino for reporting about PO. Something like transaction ME2L, ME2M, ME2K on R/3. Thanks enzo

  • YouTube videos usually don't load unless...

    Hey guys, This is my first time on the forum, so I would appreciate some help as well as some leniency if I sound stupid. So anyways... sometimes, YouTube videos I try to play load and play just fine, but most of the time, the video won't start until

  • 2D queue problem

    I needed to enqueue a 2D data array but thought instead I could use two 1D arrays I have attached my code as the LED and waveform charts are not changing or displaying anything. can someone please help?? Attachments: ProducerConsumerData 26.vi ‏36 KB

  • With adobe export pdf

    with adobe export pdf - can i just split a pdf file in different parts keeping them all in pdf format?