Cannot ping or telnet to new 2948G switch

I just installed a new 2948G switch and assigned the me1 interface an IP address... it's working fine (except for a small blip yesterday due to a duplicate IP address - oops)
I cannot ping the switch's IP address, nor can I telnet to it from the same subnet. if I console into the switch, i cannot ping anything FROM the switch. If I issue a "show arp" command I get NOTHING.
this doesn't make any sense. The switch is running CatOS4000.

make sure the default gateway is correct . Also you cannot have both the SC0 interface and the ME1 interface active at the same time and the Sc0 is the active one by default because that is what most people use . Shutdown the SC0 interface if it is still active and make sure the ME is up . "set interface sc0 down" . A show interface command will show you the status of both these interfaces. "set int me1 up"
Also by using the me1 interface you are limiting the switch ,below is a little blurb out of the catos config guide.
The in-band (sc0) management interface is connected to the switching fabric and participates in all of the functions of a normal switch port, such as spanning tree, Cisco Discovery Protocol (CDP), and VLAN membership. The out-of-band management interfaces (me1 and sl0) are not connected to the switching fabric and do not participate in any of these functions.

Similar Messages

  • Cannot ping two devices through remote access-SSH

    one of our gold partner called me and advised that he cannot ping or SSh to two of the 4948 switch.however if he logged to the core switch the 6500 he can sub telnet to the 4900.but he cannot telnet directly through SSH to the 4900.i have checked the config for SSH on both device and this is configure correctly.can any one help and tell me why we cant ping or SSH to these two devices directly rather than telneting to the core device it self before telneting to the 4900s.This is very urgent

    Hi
    Just to clarify. This is how i understand what you have set up
    You have a management vlan for the switches. The layer 3 SVI for this vlan is on your core switch.
    The other switches you have all have IP addresses for management from the same management vlan.
    Each switch should have a default gateway set and this default gateway should be the Layer 3 SVI on your core switch. (If you are running a pair of core switches you may well be using HSRP so your switches default gateway would be the virtual IP.
    The vlan that your switch layer 3 management is in, is this the same vlan as the management vlan ie.
    what vlan interface is the default gateway in ?
    if you cannot ping the default gateway from the switch this sounds like you have your vlans messed up.
    Could you provide configs of the 4948, the core switch and another switch that works
    Jon

  • Cannot ping brand new SRW248G4?

    I cannot ping our brand new SRW248G4:
    Pinging 192.168.1.254 with 32 bytes of data:
    Request timed out.
    Request timed out.
    Request timed out.
    Request timed out.
    Ping statistics for 192.168.1.254:
        Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),
    My ipconfig is:
    IP-adresse . . . . . . . . . . . . . . . . . : 192.168.1.102
    Undernetmaske. . . . . . . . . . . . . . . . : 255.255.255.0
    Standardgateway. . . . . . . . . . . . . . . : 192.168.1.1
    DHCP-server. . . . . . . . . . . . . . . . . : 192.168.1.1
    I tried from 2 different PC's
    The Switch is working, but i cannot connect to the Web-based utillity.
    Message Edited by El Gringo on 12-05-2008 04:45 AM

    Hi there! Where is your computer and switch connected? Are they connected to the router? If you're computer is getting a valid IP from your server and you're unable to ping the switch, I would suggest connecting the computer directly to the switch and put a static IP on the computer. From there, you should be able to ping the switch. If still getting the same problem, try using console or serial cable. Use the hyperterminal. I believe that default baud rate for the device is 38400. Thanks!

  • Cannot ping/telnet/ssh to GigabitEthernet interface of Cisco AP2602

    I have a Cisco 2602 (ios ver 15.0)
    I can connect trough it's SSID normally but I can't access to the AP itself. From the AP cannot ping to gateway, even though the AP can be seen on cdp from the switch.
    But my other AP Cisco 1140 (ios 12.4) can be accessed with the same configuration on the switch (switchport mode trunk, allowed vlan 1 & 2)
    vlan 1 is for user, vlan 2 for management...
    Below is the configuration of the gigabitethernet interface of the AP 2602
    interface GigabitEthernet0
     no ip address
     no ip route-cache
     duplex auto
     speed auto
     no keepalive
    interface GigabitEthernet0.1
     encapsulation dot1Q 1 native
     no ip route-cache
     bridge-group 1
     no bridge-group 1 source-learning
     bridge-group 1 spanning-disabled
    interface GigabitEthernet0.2
     encapsulation dot1Q 2
     ip address 10.32.2.98 255.255.255.0
     no ip route-cache
     bridge-group 2
     no bridge-group 2 source-learning
     bridge-group 2 spanning-disabled
    interface BVI1
     no ip address
     no ip route-cache
    ip default-gateway 10.32.2.1
    please help

    With autonomous access point, the management has to be the native vlan.  The issue is that your vlan 1 is native and that is for users, but your management is on vlan 2 which is management. This will not work as it is a requirement to keep management on a native vlan.  You would have to move the users to a different vlan since vlan 1 is typically tagged so that you can define on the trunk port on the switch that vlan 2 is native.
    -Scott

  • WRT610N to TP-LINK SWITCH cannot ping printer on switch

    I hope you can tell me what I have done wrong.
    dslmodem ---> wrt610N ---->TP-LINK(5port) ---- HP 2600N printer, another to IOmega HD
    I cannot see either the printer nor the HD. I cannot ping them.
    The cables from the TP to the printer are blue, CAT5 cables. Does blue mean twisted pair?
    The HP and IOmega have static  IP addresses at 192.168.1.2 and 192.168.1.3 each.
    The DHCP settings on the router allocate DHCP from 100-254 to avoid conflicts.
    The firewall on the WRT610N is disabled.
    Physical limitations permit only one CAT5 cable to the TPLINK box.
    If I avoid the box and do this;
    dslmodem ---> wrt610N ---->HP 2600N printer
    I can ping it from both a Windows 7 and/or XP machine.
    However, with the switch in place, I cannot ping it from the router nor any PC's connected to it. The PCs can ping each other.
    Could someone please tell me what I am doing wrong?
    Thank you in advance.

    The device is a TPLINK TL-SF1005D unmanaged 5 port switch. No visible settings or buttons.
    The address handed out on other side of the TPLINK is 169.254.138.233
    My network is 192.168.1.* 
    Hmm. This does not bode well.
    Should I set up a routing table entry to talk to this switch?
    The wire from the router is hooked to port 1 on the switch. Should it not pick up the right submask, entry from the router?
    Thanks for all your help?
    ------------------------------------DUMP------------------------------------------------------
    Microsoft Windows [Version 6.1.7600]
    Copyright (c) 2009 Microsoft Corporation.  All rights reserved.
    C:\Users\abbu>ipconfig /all
    Windows IP Configuration
       Host Name . . . . . . . . . . . . : abbu-VAIO
       Primary Dns Suffix  . . . . . . . :
       Node Type . . . . . . . . . . . . : Hybrid
       IP Routing Enabled. . . . . . . . : No
       WINS Proxy Enabled. . . . . . . . : No
    Ethernet adapter Local Area Connection:
       Connection-specific DNS Suffix  . :
       Description . . . . . . . . . . . : Marvell Yukon 88E8059 PCI-E Gigabit Ether
    net Controller
       Physical Address. . . . . . . . . : 54-42-49-02-CA-BC
       DHCP Enabled. . . . . . . . . . . : Yes
       Autoconfiguration Enabled . . . . : Yes
       Link-local IPv6 Address . . . . . : fe80::d08e:934c:6554:8ae9%12(Preferred)
       Autoconfiguration IPv4 Address. . : 169.254.138.233(Preferred)
       Subnet Mask . . . . . . . . . . . : 255.255.0.0
       Default Gateway . . . . . . . . . :
       DHCPv6 IAID . . . . . . . . . . . : 385885374
       DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-13-32-51-44-54-42-49-02-CA-BC
       DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
                                           fec0:0:0:ffff::2%1
                                           fec0:0:0:ffff::3%1
       NetBIOS over Tcpip. . . . . . . . : Enabled
    Wireless LAN adapter Wireless Network Connection:
       Media State . . . . . . . . . . . : Media disconnected
       Connection-specific DNS Suffix  . : lan
       Description . . . . . . . . . . . : Atheros AR9285 Wireless Network Adapter
       Physical Address. . . . . . . . . : 2C-81-58-FD-87-69
       DHCP Enabled. . . . . . . . . . . : Yes
       Autoconfiguration Enabled . . . . : Yes
    Tunnel adapter isatap.lan:
       Media State . . . . . . . . . . . : Media disconnected
       Connection-specific DNS Suffix  . :
       Description . . . . . . . . . . . : Microsoft ISATAP Adapter
       Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
       DHCP Enabled. . . . . . . . . . . : No
       Autoconfiguration Enabled . . . . : Yes
    Tunnel adapter isatap.{6DD0B22D-C026-4940-9700-1362E8BA5673}:
       Media State . . . . . . . . . . . : Media disconnected
       Connection-specific DNS Suffix  . :
       Description . . . . . . . . . . . : Microsoft ISATAP Adapter #2
       Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
       DHCP Enabled. . . . . . . . . . . : No
       Autoconfiguration Enabled . . . . : Yes
    Tunnel adapter Teredo Tunneling Pseudo-Interface:
       Media State . . . . . . . . . . . : Media disconnected
       Connection-specific DNS Suffix  . :
       Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
       Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
       DHCP Enabled. . . . . . . . . . . : No
       Autoconfiguration Enabled . . . . : Yes
    C:\Users\abbu>

  • Cisco 1941 Router-on-a-Stick w/ 11VLANs trunked to a Cisco 2960: Can Ping a device in another VLAN, that device cannot ping back

    Cisco 1941 Router-on-a-Stick w/ 11VLANs trunked to a Cisco 2960: From the Switch I can Ping a device in another VLAN, that device cannot ping back. Some devices can ping devices in other VLANs and the device in the other VLAN can successfully return the Ping. Have a look at the attached diagram.
    Router Config:
    show run
    Building configuration...
    Current configuration : 7224 bytes
    ! Last configuration change at 09:05:48 EDT Wed Aug 6 2014
    version 15.2
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname ROUTER
    boot-start-marker
    boot-end-marker
    no aaa new-model
    clock timezone EDT -8 0
    ip cef
    ip name-server 8.8.8.8
    no ipv6 cef
    multilink bundle-name authenticated
    license udi pid CISCO1941/K9
    object-group network Net_Obj_Group1 
     description This network group allows all 10.0.0.0 and Email Forwarder server through to the Plt PCs
     205.191.0.0 255.255.0.0
     10.0.0.0 255.0.0.0
    object-group network Net_Obj_Group2 
     description This Network Group includes the Host IPs allowed through the Plant Router
     host 10.194.28.23
     host 10.194.28.25
     host 10.194.28.26
     host 10.194.28.27
     host 10.194.28.28
     host 10.194.28.29
     host 10.194.28.37
     host 10.194.28.39
     host 10.194.28.40
     host 10.194.28.70
     host 10.194.28.130
     host 10.194.28.131
     host 10.194.28.132
     host 10.194.28.133
     host 10.194.28.134
     host 10.194.28.135
     host 10.194.28.136
     host 10.194.28.137
     host 10.194.28.138
     host 10.194.28.139
     host 10.194.28.140
     host 10.194.28.141
    interface Embedded-Service-Engine0/0
     no ip address
     shutdown
    interface GigabitEthernet0/0
     description Port Ge0/0 to IT Enterprise network Switch GE1/0/38
     ip address 10.194.28.111 255.255.255.0
     ip access-group 105 in
     ip access-group 106 out
     ip nat outside
     ip virtual-reassembly in
     shutdown
     duplex full
     speed auto
     no mop enabled
    interface GigabitEthernet0/1
     description Port to Plant PCN-K/L24 Sw1 Port 0/24
     no ip address
     duplex auto
     speed auto
     no mop enabled
    interface GigabitEthernet0/1.102
     description Port to VLAN 102
     encapsulation dot1Q 102
     ip address 192.168.102.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
    interface GigabitEthernet0/1.104
     description Port to VLAN 104
     encapsulation dot1Q 104
     ip address 192.168.104.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
    interface GigabitEthernet0/1.105
     description Port to VLAN 105
     encapsulation dot1Q 105
     ip address 192.168.105.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
    interface GigabitEthernet0/1.106
     description Port to VLAN 106
     encapsulation dot1Q 106
     ip address 192.168.106.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
    interface GigabitEthernet0/1.107
     description Port to VLAN 107
     encapsulation dot1Q 107
     ip address 192.168.107.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
    interface GigabitEthernet0/1.111
     description Port to VLAN 111
     encapsulation dot1Q 111
     ip address 192.168.111.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
    interface GigabitEthernet0/1.117
     description Port to VLAN 117
     encapsulation dot1Q 117
     ip address 192.168.117.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
    interface GigabitEthernet0/1.121
     description Port to VLAN 121
     encapsulation dot1Q 121
     ip address 192.168.121.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
    interface GigabitEthernet0/1.125
     description Port to VLAN 125
     encapsulation dot1Q 125
     ip address 192.168.125.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
    interface GigabitEthernet0/1.150
     description Port to to VLAN 150
     encapsulation dot1Q 150
     ip address 192.168.150.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
    interface GigabitEthernet0/1.999
     description Port to VLAN 999
     encapsulation dot1Q 999
     ip address 192.168.0.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
    ip forward-protocol nd
    ip http server
    no ip http secure-server
    ip nat inside source static 192.168.102.201 10.194.28.23
    ip nat inside source static 192.168.121.201 10.194.28.25
    ip nat inside source static 192.168.106.251 10.194.28.26
    ip nat inside source static 192.168.107.245 10.194.28.27
    ip nat inside source static 192.168.102.251 10.194.28.28
    ip nat inside source static 192.168.150.201 10.194.28.29
    ip nat inside source static 192.168.107.179 10.194.28.37
    ip nat inside source static 192.168.111.201 10.194.28.39
    ip nat inside source static 192.168.105.201 10.194.28.40
    ip nat inside source static 192.168.106.21 10.194.28.70
    ip nat inside source static 192.168.107.146 10.194.28.130
    ip nat inside source static 192.168.107.156 10.194.28.131
    ip nat inside source static 192.168.107.161 10.194.28.132
    ip nat inside source static 192.168.107.181 10.194.28.133
    ip nat inside source static 192.168.107.191 10.194.28.134
    ip nat inside source static 192.168.106.202 10.194.28.135
    ip nat inside source static 192.168.106.212 10.194.28.136
    ip nat inside source static 192.168.117.190 10.194.28.137
    ip nat inside source static 192.168.117.100 10.194.28.138
    ip nat inside source static 192.168.106.242 10.194.28.139
    ip nat inside source static 192.168.125.100 10.194.28.140
    ip nat inside source static 192.168.125.99 10.194.28.141
    ip nat outside source static 10.194.28.23 10.194.28.23
    ip nat outside source static 10.194.28.25 10.194.28.25
    ip nat outside source static 10.194.28.26 10.194.28.26
    ip nat outside source static 10.194.28.27 10.194.28.27
    ip nat outside source static 10.194.28.28 10.194.28.28
    ip nat outside source static 10.194.28.29 10.194.28.29
    ip nat outside source static 10.194.28.37 10.194.28.37
    ip nat outside source static 10.194.28.39 10.194.28.39
    ip nat outside source static 10.194.28.40 10.194.28.40
    ip nat outside source static 10.194.28.70 10.194.28.70
    ip nat outside source static 10.194.28.130 10.194.28.130
    ip nat outside source static 10.194.28.131 10.194.28.131
    ip nat outside source static 10.194.28.132 10.194.28.132
    ip nat outside source static 10.194.28.133 10.194.28.133
    ip nat outside source static 10.194.28.134 10.194.28.134
    ip nat outside source static 10.194.28.135 10.194.28.135
    ip nat outside source static 10.194.28.136 10.194.28.136
    ip nat outside source static 10.194.28.137 10.194.28.137
    ip nat outside source static 10.194.28.138 10.194.28.138
    ip nat outside source static 10.194.28.139 10.194.28.139
    ip nat outside source static 10.194.28.140 10.194.28.140
    ip nat outside source static 10.194.28.141 10.194.28.141
    ip route 0.0.0.0 0.0.0.0 10.194.28.1
    access-list 105 permit ip object-group Net_Obj_Group1 object-group Net_Obj_Group2
    access-list 106 permit ip object-group Net_Obj_Group2 object-group Net_Obj_Group1
    dialer-list 1 protocol ip permit
    control-plane
    banner login ^CC
    Login banner for Plant Router #01^C
    banner motd ^CC
    MOTD Banner for Plant Router^C
    line con 0
     password XXXXXXXXX
     logging synchronous
     login
    line aux 0
    line 2
     no activation-character
     no exec
     transport preferred none
     transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
     stopbits 1
    line vty 0 4
     password XXXXXXXXX
     logging synchronous
     login
     transport input all
    scheduler allocate 20000 1000
    ntp server 10.199.100.92
    end
    Switch Config:
    sh ru
    Building configuration...
    Current configuration : 6513 bytes
    version 12.2
    no service pad
    service timestamps debug uptime
    service timestamps log datetime localtime show-timezone
    service password-encryption
    hostname K24Sw01
    boot-start-marker
    boot-end-marker
    no aaa new-model
    clock timezone EDT -5
    clock summer-time EDT recurring
    udld aggressive
    crypto pki trustpoint TP-self-signed-593746944
     enrollment selfsigned
     subject-name cn=IOS-Self-Signed-Certificate-593746944
     revocation-check none
     rsakeypair TP-self-signed-593746944
      4B58BCE9 44
      quit
    spanning-tree mode pvst
    spanning-tree extend system-id
    vlan internal allocation policy ascending
    interface FastEthernet0
     no ip address
    interface GigabitEthernet0/1
     description Trunk port for vlans 105, 111, 125 and 999 from K24Sw01 port Ge0/1 to P22Sw01 port Ge0/24
     switchport trunk allowed vlan 105,111,125,999
     switchport mode trunk
    interface GigabitEthernet0/2
     description Trunk port for vlans 150 and 999 from K24Sw01 port Ge0/2 to N25Sw01 port Ge0/26
     switchport trunk allowed vlan 150,999
     switchport mode trunk
    interface GigabitEthernet0/3
     description Trunk port for vlans 102, 104, 106, 107, 117 and 999 from K24Sw01 port Ge0/3 to K28Sw01 port Ge0/26
     switchport trunk allowed vlan 102,104,106,107,117,999
     switchport mode trunk
    interface GigabitEthernet0/4
     description Trunk port for vlans 102, 106, 107 and 999 from K24Sw01 port Ge0/4 to H23Sw01 port Ge0/26
     switchport trunk allowed vlan 102,106,107,999
     switchport mode trunk
    interface GigabitEthernet0/5
     description Trunk port for vlans 121, 125 and 999 from K24Sw01 port Ge0/5 to M21Sw01 port Ge0/24
     switchport trunk allowed vlan 121,125,999
     switchport mode trunk
    interface GigabitEthernet0/6
     description OPEN
     spanning-tree portfast
    interface GigabitEthernet0/7
     description OPEN
     spanning-tree portfast
    interface GigabitEthernet0/8
     description OPEN
     spanning-tree portfast
    interface GigabitEthernet0/9
     description OPEN
     spanning-tree portfast
    interface GigabitEthernet0/10
     description VLan 102 access port
     switchport access vlan 102
     spanning-tree portfast
    interface GigabitEthernet0/11
     description - VLan 104 access port
     switchport access vlan 104
     spanning-tree portfast
    interface GigabitEthernet0/12
     description - VLan 105 access port
     switchport access vlan 105
     spanning-tree portfast
    interface GigabitEthernet0/13
     description - VLan 106 access port
     switchport access vlan 106
     spanning-tree portfast
    interface GigabitEthernet0/14
     description - VLan 107 access port
     switchport access vlan 107
     spanning-tree portfast
    interface GigabitEthernet0/15
     description - VLan 111 access port
     switchport access vlan 111
     spanning-tree portfast
    interface GigabitEthernet0/16
     description - VLan 117 access port
     switchport access vlan 117
     spanning-tree portfast
    interface GigabitEthernet0/17
     description - VLan 121 access port
     switchport access vlan 121
     spanning-tree portfast
    interface GigabitEthernet0/18
     description - VLan 125 access port
     switchport access vlan 125
     spanning-tree portfast
    interface GigabitEthernet0/19
     description - VLan 150 access port
     switchport access vlan 150
     spanning-tree portfast
    interface GigabitEthernet0/20
     description - VLan 999 access port
     switchport access vlan 999
     spanning-tree portfast
    interface GigabitEthernet0/21
     description OPEN
     spanning-tree portfast
    interface GigabitEthernet0/22
     description OPEN
     spanning-tree portfast
    interface GigabitEthernet0/23
     description OPEN
     spanning-tree portfast
    interface GigabitEthernet0/24
     description From ROUTER Gw ge0/1
     switchport trunk allowed vlan 102,104-107,111,117,121,125,150,999
     switchport mode trunk
    interface GigabitEthernet0/25
    interface GigabitEthernet0/26
    interface Vlan1
     no ip address
     no ip route-cache
     shutdown
    interface Vlan102
     ip address 192.168.102.253 255.255.255.0
    interface Vlan104
     no ip address
     no ip route-cache
    interface Vlan105
     no ip address
     no ip route-cache
    interface Vlan106
     no ip address
     no ip route-cache
    interface Vlan107
     no ip address
     no ip route-cache
    interface Vlan111
     no ip address
     no ip route-cache
    interface Vlan117
     no ip address
     no ip route-cache
    interface Vlan121
     no ip address
     no ip route-cache
    interface Vlan125
     no ip address
     no ip route-cache
    interface Vlan150
     no ip address
     no ip route-cache
    interface Vlan999
     no ip address
     no ip route-cache
    ip default-gateway 192.168.102.1
    ip http server
    ip http secure-server
    snmp-server engineID local 00000009020000019634C2C0
    snmp-server community public RO
    snmp-server location 
    snmp-server contact 
    banner motd ^CCC ADMIN USE ONLY! ^C
    line con 0
     session-timeout 10 
     password xxxxxx
     logging synchronous
     login
     stopbits 1
    line vty 0 4
     session-timeout 10 
     password xxxxxxx
     login
    line vty 5 15
     session-timeout 10 
     password xxxxxxxx
     login
    ntp server 10.199.100.92
    end
    K24Sw01#

    HI Mark,
    Here is the my config:
    Create sub-interfaces, set 802.1Q trunking protocol and ip address on each sub-interface
    Router(config)#interface f0/0
    Router(config-if)#no shutdown
    (Note: The main interface f0/0 doesn’t need an IP address but it must be turned on)
    Router(config)#interface f0/0.10
    Router(config-subif)#encapsulation dot1q 10
    Router(config-subif)#ip address 192.168.10.1 255.255.255.0
    Router(config-subif)#interface f0/0.20
    Router(config-subif)#encapsulation dot11 20
    Router(config-subif)#ip address 192.168.20.1 255.255.255.0
    (Note: In the “encapsulation dot1q 10″ command, 10 is the VLAN ID this interface operates in)
    Configure VLAN
    Switch(config)#vlan 10
    Switch(config-vlan)#name SALES
    Switch(config-vlan)#vlan 20
    Switch(config-vlan)#name TECH
    Set ports to access mode & assign ports to VLAN
    Switch(config)#interface range fa0/1
    Switch(config-if)#no shutdown
    Switch(config-if)# switchport mode access
    Switch(config-if)# switchport access vlan 15
    Switch(config-if)#interface range fa0/3
    Switch(config-if)#no shutdown
    Switch(config-if)#switchport mode access
    Switch(config-if)# switchport access vlan 20
    Switch(config-if)#interface range fa0/5
    Switch(config-if)#no shutdown
    Switch(config-if)#switchport mode trunk
    1. Please check all your port are up.
    2. Check the config once again.
    3. Make sure the swicth and router connection port configured as trunk and it should be up.
    This config is working for me,
    Regards
    Dont forget to rate helpful posts.

  • Need HELPS! ASA 5505 8.4 Cisco VPN Client cannot ping any internal host

    Hi:
    Need your great help for my new ASA 5505 (8.4)
    I just set a new ASA 5505 with 8.4. However, I cannot ping any host after VPN in with Cisco VPN client. Please see below posted configuration file, thanks for any suggestion.
    ASA Version 8.4(3)
    names
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    switchport access vlan 2
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 100
    ip address 172.29.8.254 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address 177.164.222.140 255.255.255.248
    ftp mode passive
    clock timezone GMT 0
    dns server-group DefaultDNS
    domain-name ABCtech.com
    same-security-traffic permit inter-interface
    object network obj_any
    subnet 172.29.8.0 255.255.255.0
    object service RDP
    service tcp source eq 3389
    object network orange
    host 172.29.8.151
    object network WAN_173_164_222_138
    host 177.164.222.138
    object service SMTP
    service tcp source eq smtp
    object service PPTP
    service tcp source eq pptp
    object service JT_WWW
    service tcp source eq www
    object service JT_HTTPS
    service tcp source eq https
    object network obj_lex
    subnet 172.29.88.0 255.255.255.0
    description Lexington office network
    object network obj_HQ
    subnet 172.29.8.0 255.255.255.0
    object network guava
    host 172.29.8.3
    object service L2TP
    service udp source eq 1701
    access-list VPN_Tunnel_User standard permit 172.29.8.0 255.255.255.0
    access-list VPN_Tunnel_User standard permit 172.29.88.0 255.255.255.0
    access-list inside_access_in extended permit icmp any any
    access-list inside_access_in extended deny tcp any any eq 135
    access-list inside_access_in extended deny tcp any eq 135 any
    access-list inside_access_in extended deny udp any eq 135 any
    access-list inside_access_in extended deny udp any any eq 135
    access-list inside_access_in extended deny tcp any any eq 1591
    access-list inside_access_in extended deny tcp any eq 1591 any
    access-list inside_access_in extended deny udp any eq 1591 any
    access-list inside_access_in extended deny udp any any eq 1591
    access-list inside_access_in extended deny tcp any any eq 1214
    access-list inside_access_in extended deny tcp any eq 1214 any
    access-list inside_access_in extended deny udp any any eq 1214
    access-list inside_access_in extended deny udp any eq 1214 any
    access-list inside_access_in extended permit ip any any
    access-list inside_access_in extended permit tcp any any eq www
    access-list inside_access_in extended permit tcp any eq www any
    access-list outside_access_in extended permit icmp any any
    access-list outside_access_in extended permit tcp any host 177.164.222.138 eq 33
    89
    access-list outside_access_in extended permit tcp any host 177.164.222.138 eq sm
    tp
    access-list outside_access_in extended permit tcp any host 177.164.222.138 eq pp
    tp
    access-list outside_access_in extended permit tcp any host 177.164.222.138 eq ww
    w
    access-list outside_access_in extended permit tcp any host 177.164.222.138 eq ht
    tps
    access-list outside_access_in extended permit gre any host 177.164.222.138
    access-list outside_access_in extended permit udp any host 177.164.222.138 eq 17
    01
    access-list outside_access_in extended permit ip any any
    access-list inside_access_out extended permit icmp any any
    access-list inside_access_out extended permit ip any any
    access-list outside_cryptomap extended permit ip 172.29.8.0 255.255.255.0 172.29
    .88.0 255.255.255.0
    access-list inside_in extended permit icmp any any
    access-list inside_in extended permit ip any any
    access-list inside_in extended permit udp any any eq isakmp
    access-list inside_in extended permit udp any eq isakmp any
    access-list inside_in extended permit udp any any
    access-list inside_in extended permit tcp any any
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    ip local pool ABC_HQVPN_DHCP 172.29.8.210-172.29.8.230 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    asdm history enable
    arp timeout 14400
    nat (inside,outside) source static orange interface service RDP RDP
    nat (inside,outside) source static obj_HQ obj_HQ destination static obj_lex obj_
    lex route-lookup
    nat (inside,outside) source static guava WAN_173_164_222_138 service JT_WWW JT_W
    WW
    nat (inside,outside) source static guava WAN_173_164_222_138 service JT_HTTPS JT
    _HTTPS
    nat (inside,outside) source static guava WAN_173_164_222_138 service RDP RDP
    nat (inside,outside) source static guava WAN_173_164_222_138 service SMTP SMTP
    nat (inside,outside) source static guava WAN_173_164_222_138 service PPTP PPTP
    nat (inside,outside) source static guava WAN_173_164_222_138 service L2TP L2TP
    object network obj_any
    nat (inside,outside) dynamic interface
    access-group inside_in in interface inside
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 177.164.222.142 1
    route inside 172.29.168.0 255.255.255.0 172.29.8.253 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server Guava protocol nt
    aaa-server Guava (inside) host 172.29.8.3
    timeout 15
    nt-auth-domain-controller guava
    user-identity default-domain LOCAL
    http server enable
    http 172.29.8.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set Remote_VPN_Set esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set Remote_vpn_set esp-3des esp-md5-hmac
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto dynamic-map outside_dyn_map 20 set ikev1 transform-set Remote_VPN_Set
    crypto dynamic-map outside_dyn_map 20 set reverse-route
    crypto map outside_map 1 match address outside_cryptomap
    crypto map outside_map 1 set peer 173.190.123.138
    crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5
    ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ES
    P-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 1 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
    crypto map outside_map interface outside
    crypto ikev2 policy 1
    encryption aes-256
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    encryption des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable outside
    crypto ikev1 enable outside
    crypto ikev1 policy 1
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 43200
    crypto ikev1 policy 10
    authentication crack
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 20
    authentication rsa-sig
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 30
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 40
    authentication crack
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 50
    authentication rsa-sig
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 60
    authentication pre-share
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 70
    authentication crack
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 80
    authentication rsa-sig
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 90
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 100
    authentication crack
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 110
    authentication rsa-sig
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 120
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 130
    authentication crack
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 140
    authentication rsa-sig
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 150
    authentication pre-share
    encryption des
    hash sha
    group 2
    lifetime 86400
    telnet 192.168.1.0 255.255.255.0 inside
    telnet 172.29.8.0 255.255.255.0 inside
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside vpnclient-wins-override
    dhcprelay server 172.29.8.3 inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    enable outside
    group-policy ABCtech_VPN internal
    group-policy ABCtech_VPN attributes
    dns-server value 172.29.8.3
    vpn-tunnel-protocol ikev1
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value VPN_Tunnel_User
    default-domain value ABCtech.local
    group-policy GroupPolicy_10.8.8.1 internal
    group-policy GroupPolicy_10.8.8.1 attributes
    vpn-tunnel-protocol ikev1 ikev2
    username who password eicyrfJBrqOaxQvS encrypted
    tunnel-group 10.8.8.1 type ipsec-l2l
    tunnel-group 10.8.8.1 general-attributes
    default-group-policy GroupPolicy_10.8.8.1
    tunnel-group 10.8.8.1 ipsec-attributes
    ikev1 pre-shared-key *****
    ikev2 remote-authentication pre-shared-key *****
    ikev2 remote-authentication certificate
    ikev2 local-authentication pre-shared-key *****
    tunnel-group ABCtech type remote-access
    tunnel-group ABCtech general-attributes
    address-pool ABC_HQVPN_DHCP
    authentication-server-group Guava
    default-group-policy ABCtech_VPN
    tunnel-group ABCtech ipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group 173.190.123.138 type ipsec-l2l
    tunnel-group 173.190.123.138 general-attributes
    default-group-policy GroupPolicy_10.8.8.1
    tunnel-group 173.190.123.138 ipsec-attributes
    ikev1 pre-shared-key *****
    ikev2 remote-authentication pre-shared-key *****
    ikev2 remote-authentication certificate
    ikev2 local-authentication pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map global_policy
    class inspection_default
      inspect pptp
      inspect ftp
      inspect netbios
    smtp-server 172.29.8.3
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:6a26676668b742900360f924b4bc80de
    : end

    Hello Wayne,
    Can you use a different subnet range than the internal interface, this could cause you a LOT of issues and hours on troubleshooting, so use a dedicated different Ip address range...
    I can see that the local Pool range is included into the inside interface Ip address subnet range, change that and the related config ( NAT,etc, ) and let us know what happens,
    Regards,
    Julio
    Security Trainer

  • 2851 router vpn to 851 router lan clients cannot ping

    Greets - I'm expanding my lab experience by adding a 2851 router to my mix of 18xx and 851/871 units. Some of this infrastructure is in production, some just lab work. I have established good connectivity between 18xx's and 851/871's with IPSEC VPNs (site-to-site static and dynamic), but my problem is with adding in a 2851.
    Setup: 2851 with 12.4 ADVENTK9, WAN on GE0/0 as 216.189.223.bbb/26, LAN on GE0/1 as 172.20.0.1/20 (VPN module, but no additional HWIC modules)
    851 with 12.4 ADVENTK9, WAN on FE4 as 216.53.254.aaa/24, LAN on FE0..3 via BVI1 as 172.21.1.1/24
    The two router WAN ports are bridged via a 3rd router (a Zywall with 216.0.0.0/8 route, with the router at 216.1.1.1) affectionately called the "InterNOT", which provides a surrogate to the great web, minus actual other hosts and dns, but it doesn't matter. As both my WAN addresses are within 216.x.x.x, this works quite well. This surrogate has tested fine and is known to not be part of a problem.
    The 851 has been tested against another 851 with complementary setup and a successful VPN can run between the two.
    I have good LAN-WAN connections on each router. I do have a "Good" VPN connection between the two routers.
    The problem: I cannot ping from a LAN host on 172.20.x.x on the 2851 to any 172.21.1.x (eg 172.21.1.1) host on the 851, and vice versa.
    From a LAN host, I can ping to my InterNOT - for example a dhcp host 172.20.6.2 on the 2851 LAN can ping 216.1.1.1 fine. I can also ping the 851's WAN address at 216.53.254.aaa.
    To complicate matters, if I connect to the routers via console, I CAN ping across the vpn to the destination LAN hosts, in both directions.
    This seems to indicate that there is a bridging problem between the LAN interfaces to the VPN interfaces. I suspect this is a config problem on the 2851, as I have had a similar config working on my 851 to 851 site-to-site setups. I also suspect it is in the 2851's config as I'm still just starting out with this particular router.
    So some stripped-down configs:
    For the 2851:
    no service config
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname router2851
    boot-start-marker
    boot-end-marker
    no logging buffered
    no logging console
    enable password mypassword2
    no aaa new-model
    dot11 syslog
    no ip cef
    no ip dhcp use vrf connected
    ip dhcp excluded-address 172.20.0.1 172.20.6.1
    ip dhcp excluded-address 172.20.6.254 172.20.15.254
    ip dhcp pool Internal_2000
       import all
       network 172.20.0.0 255.255.240.0
       domain-name myseconddomain.int
       default-router 172.20.0.1
       lease 7
    no ip domain lookup
    multilink bundle-name authenticated
    voice-card 0
     no dspfarm
    crypto pki <<truncated>>
    crypto pki certificate chain TP-self-signed-2995823027
     <<truncated>>
          quit
    username myusername privilege 15 password 0 mypassword2
    archive
     log config
      hidekeys
    crypto isakmp policy 1
     encr 3des
     authentication pre-share
     group 2
    crypto isakmp key mysharedkey address 216.53.254.aaa
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto map SDM_CMAP_1 1 ipsec-isakmp
     description Tunnel to216.53.254.aaa
     set peer 216.53.254.aaa
     set transform-set ESP-3DES-SHA
     match address 100
    interface GigabitEthernet0/0
     description $ETH-WAN$
     ip address 216.189.223.bbb 255.255.255.192
     ip nat outside
     ip virtual-reassembly
     duplex auto
     speed auto
     crypto map SDM_CMAP_1
     no shut
    interface GigabitEthernet0/1
     description $FW_INSIDE$$ETH-LAN$
     ip address 172.20.0.1 255.255.240.0
     ip nat inside
     ip virtual-reassembly
     no ip route-cache
     duplex auto
     speed auto
     no mop enabled
    ip forward-protocol nd
    ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0
    ip http server
    ip http authentication local
    ip http secure-server
    ip dns server
    ip nat inside source route-map SDM_RMAP_1 interface GigabitEthernet0/0 overload
    access-list 1 remark CCP_ACL Category=2
    access-list 1 permit 172.20.0.0 0.0.15.255
    access-list 100 remark CCP_ACL Category=4
    access-list 100 remark IPSec Rule
    access-list 100 permit ip 172.20.0.0 0.0.15.255 172.21.1.0 0.0.0.255
    access-list 101 remark CCP_ACL Category=2
    access-list 101 remark IPSec Rule
    access-list 101 deny   ip 172.20.0.0 0.0.15.255 172.21.1.0 0.0.0.255
    access-list 101 permit ip 172.20.0.0 0.0.15.255 any
    route-map SDM_RMAP_1 permit 1
     match ip address 101
    control-plane
    banner motd ~This is a private computer system for authorized use only. And Stuff~
    line con 0
    line aux 0
    line vty 0 4
     privilege level 15
     password mypassword
     login local
     transport input telnet ssh
    scheduler allocate 20000 1000
    end
    And for the 851:
    no service pad
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname router851
    boot-start-marker
    boot-end-marker
    logging buffered 52000 debugging
    no logging console
    enable password mypassword
    aaa new-model
    aaa authentication login default local
    aaa authorization exec default local
    aaa session-id common
    resource policy
    clock timezone PCTime -5
    clock summer-time PCTime date Apr 6 2003 2:00 Oct 26 2003 2:00
    no ip dhcp use vrf connected
    ip dhcp excluded-address 172.21.1.1 172.21.1.100
    ip dhcp pool Internal_2101
       import all
       network 172.21.1.0 255.255.255.0
       default-router 172.21.1.1
       domain-name mydomain.int
       dns-server 172.21.1.10
       lease 4
    ip cef
    ip domain name mydomain.int
    ip name-server 172.21.1.10
    crypto pki <<truncated>>
    crypto pki certificate chain TP-self-signed-3077836316
     <<truncated>>
      quit
    username myusername privilege 15 password 0 mypassword2
    crypto isakmp policy 1
     encr 3des
     authentication pre-share
     group 2
    crypto isakmp key mysharedkey address 216.189.223.aaa
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA1 esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA2 esp-3des esp-sha-hmac
    crypto map SDM_CMAP_1 1 ipsec-isakmp
     description Tunnel to216.189.223.bbb
     set peer 216.189.223.bbb
     set transform-set ESP-3DES-SHA2
     match address 100
    bridge irb
    interface FastEthernet0
     spanning-tree portfast
    interface FastEthernet1
     spanning-tree portfast
    interface FastEthernet2
     spanning-tree portfast
    interface FastEthernet3
     spanning-tree portfast
    interface FastEthernet4
     description $ETH-WAN$
     ip address 216.53.254.aaa 255.255.254.0
     ip nat outside
     ip virtual-reassembly
     ip tcp adjust-mss 1460
     duplex auto
     speed auto
     no cdp enable
     crypto map SDM_CMAP_1
     no shut
    interface Vlan1
     description Internal Network
     no ip address
     ip nat inside
     ip virtual-reassembly
     bridge-group 1
     bridge-group 1 spanning-disabled
    interface BVI1
     description Bridge to Internal Network
     ip address 172.21.1.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly
    ip route 0.0.0.0 0.0.0.0 FastEthernet4
    ip route 172.21.1.0 255.255.255.0 BVI1
    ip http server
    ip http secure-server
    ip nat inside source route-map SDM_RMAP_1 interface FastEthernet4 overload
    access-list 1 remark CCP_ACL Category=2
    access-list 1 permit 172.21.1.0 0.0.0.255
    access-list 100 remark CCP_ACL Category=4
    access-list 100 remark IPSec Rule
    access-list 100 permit ip 172.21.1.0 0.0.0.255 172.20.0.0 0.0.15.255
    access-list 101 remark CCP_ACL Category=2
    access-list 101 remark IPSec Rule
    access-list 101 deny   ip 172.21.1.0 0.0.0.255 172.20.0.0 0.0.15.255
    access-list 101 remark IPSec Rule
    access-list 101 deny   ip 172.21.1.0 0.0.0.255 172.21.101.0 0.0.0.31
    access-list 101 permit ip 172.21.1.0 0.0.0.255 any
    route-map SDM_RMAP_1 permit 1
     match ip address 101
    control-plane
    bridge 1 route ip
    banner motd ~This is a private computer system for authorized use only. And Stuff.~
    line con 0
     password mypassword
     no modem enable
    line aux 0
    line vty 0 4
     password mypassword
    scheduler max-task-time 5000
    end
    Note that the above are somewhat stripped-down configs, without firewall or WAN ACL's - interestingly my default WAN-Inbound ACLs seem to break connectivity when included, so I realize I have some more cleanup to do there, but the 2851 LAN bridging seems to be what I should concentrate on first.
    I'm still googling some of the particulars with the 2851, but any assistance is appreciated.
    Regards,
    Ted.

    Hi,
    First,please delete NAT.If we configured the NAT in the RRAS,the source IP address in all packets sent to 192.168.1.0/24 would be translated to 192.168.1.224.
    Second,please enable the LAN routing in RRAS server.To enable LAN routing,please follow the steps below,
    1.In the RRAS server,Open Routing and Remote Access.
    2.Right-click the server name,then click
    properties.
    3.On the General tab,select
    IPv4 Router check box,and then click Local area network(LAN) routing only.
    Then,announce the 172.16.0.0 network to the router.
    To learn more details about enabling LAN routing, please refer to the link below,
    http://technet.microsoft.com/en-us/library/dd458974.aspx
    Best Regards,
    Tina

  • I can SSH from the outside but cannot ping ISP gateway from 2911

    Hello all,
    I came across a rather strange issue. I am able to SSH to the device from my home but while I am consoled in, I cannot ping the ISP gateway or any other IP's. As expected, all trace-routes fail without hitting the gateway as the first hop. I have been reading about the NVI0 interface and I decided to use it. Most of the sample cofigs on here use the "old" ip nat inside / outside on the appropriate interfaces. What do you guys suggest?
    Here is the running config. It is rather simple since i did not add all the access-lists except the ones I thought necessary to test the circuit. Please point out any mistakes or errors. Thanks in advance!
    Current configuration : 1679 bytes
    ! Last configuration change at 04:05:17 UTC Fri Sep 12 2014
    version 15.1
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname StandbyGZ-2911
    boot-start-marker
    boot-end-marker
    enable secret 5 $1$BRaM$igChPMXLeHjgYR7EGk/Nb/
    no aaa new-model
    no ipv6 cef
    no ip source-route
    ip cef
    no ip domain lookup
    ip domain name StandbyGZ.local
    ip name-server 211.136.20.203
    ip name-server 211.139.136.68
    multilink bundle-name authenticated
    license udi pid CISCO2911/K9 sn FGL174410H9
    username StandbyGZ secret 5 $1$CXWC$m6kqTGbf0HDLCvkfU7.RA/
    ip ssh version 2
    interface GigabitEthernet0/0
     no ip address
     shutdown
     duplex auto
     speed auto
    interface GigabitEthernet0/1
     description UPLINK TO CHINA MOBILE
     ip address 183.x.x.x 255.255.255.128
     ip access-group REMOTE-ADMIN-ACL in
     no ip redirects
     ip nat enable
     duplex auto
     speed auto
    interface GigabitEthernet0/2
     description CONNECTION TO LAN SWITCH 3650-CORE
     ip address 10.10.1.254 255.255.254.0
     no ip redirects
     ip nat enable
     duplex auto
     speed auto
    ip forward-protocol nd
    no ip http server
    no ip http secure-server
    ip nat source list LAN-NAT-ACL interface GigabitEthernet0/1 overload
    ip route 0.0.0.0 0.0.0.0 183.x.x.x
    ip access-list standard LAN-NAT-ACL
     permit 10.10.0.0 0.0.1.255
    ip access-list extended REMOTE-ADMIN-ACL
     permit tcp host 68.107.195.213 any eq 22 log
    control-plane
    line con 0
     exec-timeout 0 0
     logging synchronous
    line aux 0
    line vty 0 4
     exec-timeout 0 0
     logging synchronous
     login local
     transport input ssh
     transport output ssh
    scheduler allocate 20000 1000
    end
    StandbyGZ-2911# sh ip int br
    Interface                            IP-Address        OK?   Method      Status                  Protocol
    GigabitEthernet0/0         unassigned        YES    NVRAM     administratively  down down
    GigabitEthernet0/1         183.x.x.x             YES    NVRAM     up                         up
    GigabitEthernet0/2         10.10.1.254       YES    NVRAM     up                         up
    NVI0                                 183.x.x.x             YES    unset          up                         up
    StandbyGZ-2911#sh ip route
    Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
           D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
           N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
           E1 - OSPF external type 1, E2 - OSPF external type 2
           i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
           ia - IS-IS inter area, * - candidate default, U - per-user static route
           o - ODR, P - periodic downloaded static route, + - replicated route
    Gateway of last resort is 183.233.184.129 to network 0.0.0.0
    S*    0.0.0.0/0 [1/0] via 183.233.184.129
          10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
    C        10.10.0.0/23 is directly connected, GigabitEthernet0/2
    L        10.10.1.254/32 is directly connected, GigabitEthernet0/2
          183.233.0.0/16 is variably subnetted, 2 subnets, 2 masks
    C        183.x.x.x/25 is directly connected, GigabitEthernet0/1
    L        183.x.x.x/32 is directly connected, GigabitEthernet0/1

    Hi Chris,
    That is what how I am used to configure the NAT, but IOS 12.3 and on introduced interface NVI0, which according to cisco documentation should make applying the NAT statements "easier". IP nat enable has to be enabled on all interfaces and then NVI0 makes the "inside" and "outside" decisions. I was hoping that someone could clarify the real use of that NVI0 interface and if it causes problems. Apparently it cannot be removed from the config. 

  • 1602i standalone AP cannot ping RADIUS server

    I have a new 1602i standalone AP trying to use RADIUS authentication.  For some reason the 1602 cannot ping the RADIUS server, but will get a response from other devices.  Both are on the same subnet, the new one at .213 and the RADIUS at .209.
    AP6#ping xxx.xx.120.209
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to xxx.xx..120.209, timeout is 2 seconds:
    Success rate is 0 percent (0/5)
    AP6#ping xxx.xx.120.217
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to xxx.xx..120.217, timeout is 2 seconds:
    Success rate is 100 percent (5/5), round-trip min/avg/max = 1/3/4 ms
    The RADUIS server is able to ping the new AP successfully.
    AP1#ping xxx.xx.120.213
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to xxx.xx.120.213, timeout is 2 seconds:
    Success rate is 100 percent (5/5), round-trip min/avg/max = 2/2/3 ms
    Any thoughts to why that AP is unable to ping that one particular client?  Other APs are successfully contacting it for RADIUS authentication.

    version 15.2
    no service pad
    service timestamps debug datetime msec
    service timestamps log datetime msec
    service password-encryption
    hostname AP6
    logging rate-limit console 9
    enable secret 5 xxxxxxxxxxxx
    aaa new-model
    aaa group server radius rad_eap
     server xxx.xx.120.209 auth-port 1812 acct-port 1813
    aaa group server radius rad_mac
    aaa group server radius rad_acct
    aaa group server radius rad_admin
    aaa group server tacacs+ tac_admin
    aaa group server radius rad_pmip
    aaa group server radius dummy
    aaa authentication login eap_methods group rad_eap
    aaa authentication login mac_methods local
    aaa authorization exec default local
    aaa accounting network acct_methods start-stop group rad_acct
    aaa session-id common
    clock timezone -0500 -5 0
    clock summer-time -0400 recurring
    no ip routing
    no ip cef
    dot11 syslog
    dot11 ssid xxx.xx
       authentication open eap eap_methods
       authentication network-eap eap_methods
       authentication key-management wpa
    crypto pki token default removal timeout 0
    username Cisco privilege 15 password 7 xxxxx
    bridge irb
    interface Dot11Radio0
     no ip address
     no ip route-cache
     encryption mode ciphers tkip
     ssid  MANH
     antenna gain 0
     stbc
     beamform ofdm
     station-role root
     bridge-group 1
     bridge-group 1 subscriber-loop-control
     bridge-group 1 spanning-disabled
     bridge-group 1 block-unknown-source
     no bridge-group 1 source-learning
     no bridge-group 1 unicast-flooding
    interface Dot11Radio1
     no ip address
     no ip route-cache
     shutdown
     antenna gain 0
     dfs band 3 block
     channel dfs
     station-role root
     bridge-group 1
     bridge-group 1 subscriber-loop-control
     bridge-group 1 spanning-disabled
     bridge-group 1 block-unknown-source
     no bridge-group 1 source-learning
     no bridge-group 1 unicast-flooding
    interface GigabitEthernet0
     no ip address
     no ip route-cache
     duplex auto
     speed auto
     bridge-group 1
     bridge-group 1 spanning-disabled
     no bridge-group 1 source-learning
    interface BVI1
     ip address dhcp client-id GigabitEthernet0
     no ip route-cache
    ip forward-protocol nd
    ip http server
    no ip http secure-server
    ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
    ip radius source-interface BVI1
    snmp-server view dot11view ieee802dot11 included
    snmp-server community  RW
    snmp-server chassis-id AP6
    snmp-server enable traps snmp authentication linkdown linkup coldstart warmstart
    snmp-server enable traps tty
    snmp-server enable traps entity
    snmp-server enable traps disassociate
    snmp-server enable traps deauthenticate
    snmp-server enable traps authenticate-fail
    snmp-server enable traps dot11-qos
    snmp-server enable traps switch-over
    snmp-server enable traps rogue-ap
    snmp-server enable traps wlan-wep
    snmp-server enable traps config-copy
    snmp-server enable traps config
    snmp-server enable traps syslog
    snmp-server enable traps cpu threshold
    snmp-server enable traps aaa_server
    snmp-server host .0.39 public
    radius-server local
      user user1 nthash 7
    radius-server attribute 32 include-in-access-req format %h
    radius-server host xxx.xx.120.209 auth-port 1812 acct-port 1813 key 7
    radius-server vsa send accounting
    bridge 1 route ip
    line con 0
    line vty 0 4
     transport input all
    sntp server xxx.xx.0.11
    sntp broadcast client
    end

  • Bringing up a third interface - cannot ping servers

    Hi All,
    I have a CSS 11503 that already had 2 interfaces up and running fine. The frontend is on vlan 26 and backend server vlan is on vlan 836. Now, I have some servers on vlan 301 that needed load balancing and brought up the third interface.
    Here is my config
    interface 1/1
    bridge vlan 836
    interface 1/2
    bridge vlan 26
    interface 2/1 (this is the new interface)
    bridge vlan 301
    circuit VLAN836
    ip address 10.10.235.5 255.255.255.128
    circuit VLAN26
    ip address 10.10.26.5 255.255.255.0
    circuit VLAN301
    ip address 10.44.0.5 255.255.252.0
    Here is the "show ip route" output
    BCMDC-CSS1# sh ip route
    prefix/length next hop if type proto age metric
    10.1.20.0/22 10.1.22.150 2 mgmt local -- --
    0.0.0.0/0 10.10.26.1 1022 remote static 5342983 0
    10.44.0.0/22 10.44.0.5 1021 local local 7122 0
    10.10.26.0/24 10.10.26.5 1022 local local 5343307 0
    10.10.235.0/25 10.10.235.5 1023 local local 5343288 0
    Show arp contains all the servers I want to ping and here is the arp table on the CSS
    10.44.0.1 00-00-0c-07-ac-1f dynamic 2/1
    10.44.0.2 00-d0-02-f3-a8-00 dynamic 2/1
    10.44.0.3 00-09-12-ed-6f-00 dynamic 2/1
    10.44.0.20 00-11-25-9d-e4-98 dynamic 2/1
    10.44.0.21 00-11-25-9d-ee-d7 dynamic 2/1
    10.44.0.30 00-11-25-9d-e6-86 dynamic 2/1
    10.44.0.31 00-14-5e-3c-71-38 dynamic 2/1
    10.44.0.32 00-11-25-4a-82-a1 dynamic 2/1
    10.44.0.33 00-14-5e-3e-60-e1 dynamic 2/1
    10.44.0.34 00-11-25-9e-e5-ce dynamic 2/1
    10.44.0.35 00-11-25-9c-66-c9 dynamic 2/1
    10.44.0.40 00-1a-64-4f-21-bc dynamic 2/1
    10.44.0.41 00-1a-64-4f-23-6e dynamic 2/1
    10.44.0.50 00-1a-64-4f-2f-74 dynamic 2/1
    10.44.0.51 00-1a-64-4f-22-72 dynamic 2/1
    10.44.0.60 00-1a-64-4f-1c-ba dynamic 2/1
    10.44.0.61 00-1a-64-4f-13-06 dynamic 2/1
    I cannot ping any of the 10.44.0.x address. The interface is up and it is connected to a 6509 switch as an accessport on vlan301 and it shows up and up.
    There are no ACLs configured. I am just trying to ping the servers before I can write the content rules.
    Any ideas?

    OK. I figured out that I cannot ping the servers. But, I cannot ping the circuit vlan 301 IP from the router which is 10.44.0.5.
    However, I can ping vlan 836 circuit IP like 10.10.235.5 Here is the ping result from the router where the css is connected to
    gw1>ping 10.10.235.5
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 10.10.235.5, timeout is 2 seconds:
    Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
    gw1>ping 10.44.0.5
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 10.44.0.5, timeout is 2 seconds:
    Success rate is 0 percent (0/5)

  • ACE 4700 - Cannot Ping the Alias

    I cannot ping my alias addresses. I can ping the actual interface addresses but not the alias. When I look at the ARP entry on the switch it's connected to for the alias, it comes up INCOMPLETE.
    Below is my config.
    interface gigabitEthernet 1/1
    description Fault Tolerant Port
    ft-port vlan 990
    no shutdown
    interface gigabitEthernet 1/2
    shutdown
    interface gigabitEthernet 1/3
    shutdown
    interface gigabitEthernet 1/4
    switchport trunk allowed vlan 10,112,200,254
    no shutdown
    resource-class RC1
    limit-resource all minimum 20.00 maximum unlimited
    limit-resource sticky minimum 8.00 maximum unlimited
    boot system image:c4710ace-mz.A1_7b.bin
    hostname atl-ace-01
    access-list ALL line 8 extended permit ip any any
    class-map type management match-any PING
    2 match protocol icmp any
    class-map type management match-all SNMP-ALLOW_CLASS
    2 match protocol snmp source-address 10.150.100.202 255.255.255.255
    class-map type management match-any remote_access
    2 match protocol xml-https any
    4 match protocol icmp any
    5 match protocol telnet any
    6 match protocol ssh any
    7 match protocol http any
    8 match protocol https any
    9 match protocol snmp any
    policy-map type management first-match AllowICMP
    class PING
    permit
    policy-map type management first-match SNMP-ALLOW_POLICY
    class SNMP-ALLOW_CLASS
    policy-map type management first-match remote_mgmt_allow_policy
    class remote_access
    permit
    interface vlan 200
    ip address 10.10.200.110 255.255.254.0
    alias 10.10.200.120 255.255.254.0
    peer ip address 10.10.200.111 255.255.254.0
    access-group input ALL
    service-policy input remote_mgmt_allow_policy
    service-policy input SNMP-ALLOW_POLICY
    service-policy input AllowICMP
    no shutdown
    ft interface vlan 990
    ip address 192.168.254.1 255.255.255.0
    peer ip address 192.168.254.2 255.255.255.0
    no shutdown
    ft peer 1
    heartbeat interval 250
    heartbeat count 10
    ft-interface vlan 990
    ip route 0.0.0.0 0.0.0.0 10.10.201.254
    context Exchange-CAS
    allocate-interface vlan 112
    allocate-interface vlan 254
    member RC1
    ft group 1
    peer 1
    priority 200
    peer priority 190
    associate-context Exchange-CAS
    inservice

    Nevermind. I found an old Context on the redundant ACE with overlapping info.

  • Cannot ping loopback - revisited

    I don't really understand why the answer to the question worked before, but I have an almost identical problem. Here's the old discussion:
    https://supportforums.cisco.com/discussion/11563226/cannot-ping-loopback
    I can't ping the loopback on a Catalyst 2960.
    I have a VLAN 33 on a 10.0.33.0 subnet. This is being routed over an 881 using an SVI (with 10.0.33.1) on the back side. I looked for the pings in Wireshark, but to my surprise they didn't exist! Then I captured again to see why I missed them, and subsequently discovered that the ARPs aren't being replied to by the loopback.
    But this I don't think I understand. If the loopback IP address in on the same subnet as that assigned to the VLAN on the port coming into the switch, wouldn't it just switch the traffic over to the loopback interface? Why won't it answer the ARP request?
    So then the other problem will be... If I don't use the same subnet for the loopback, how do I manage the switch via telnet/ssh over the network? It seemed like according to the other discussion, there would have to be some kind of other subnet for the loopback interface than what was already being advertised by the router for the VLAN SVI -- do I get that correctly?
    Any ideas?

    Jeremy,
    But then, if I do want to create a management VLAN for the express purpose of being able to manage the L2 devices via telnet/ssh, they need to have an IP address and that needs to be on the loopback interface, right?
    No. The address will be assigned to the interface Vlan you create for the particular management VLAN. Assume 4 switches in your network, connected together via trunks. Let's say you have decided to have VLAN 1000 as your management VLAN. So each of your switches would then be configured as follows:
    vlan 1000
     name Management
    interface Vlan1
     shutdown
    interface Vlan1000
     ip address 10.255.255.<SwitchNumber> 255.255.255.0
     no shutdown
    ip default-gateway 10.255.255.254
    This simple example assumes that all switches are already connected together via trunks so that VLAN 1000 can span all of them. Then, the interface Vlan (SVI) for VLAN 1 is shutdown, as the VLAN 1 is not going to be your management VLAN anymore, and instead, a SVI for VLAN 1000 is created and an IP address is assigned to it. Finally, each switch has its default gateway out of its management VLAN configured - assuming the router that also must be connected to the VLAN 1000 has its IP address 10.255.255.254.
    As you your numbered sequence:
    Correct.
    Correct; be aware that you do not assign SVIs to VLANs. SVI is by its very definition associated with its (and only its) VLAN; e.g. interface Vlan 123 is automatically associated with VLAN 123 and can never, ever, be associated with any other VLAN
    Correct.
    Incorrect. Once the SVI has its IP address assigned, why would you want to put the address on some other interface? Loopback interfaces are mostly usable on routers which have many IP addresses so that the loopback interface can be used as a single IP for the entire router. However, Layer2 switches normally have only one IP address and that one is already enough for management purposes. There is no benefit gained by using loopback interfaces on Layer2 switches.
    Regarding reading about management VLANs - I suppose that googling for it will produce myriads of results. Check out this one, for example:
    http://www.freeccnaworkbook.com/workbooks/ccna/configuring-a-management-vlan-interface
    Best regards,
    Peter

  • Cannot ping gateway

    hi,
    i have wlc directly connected to core switch in same subnet and same vlan,
    core switch connected to othe edege switches and APs connected to them.
    I cannot ping wlc from core switch, i dont know how but connected APs are working fine
    and users are also able to browse.
    Pls suggest on this

    /* Style Definitions */
    table.MsoNormalTable
    {mso-style-name:"Table Normal";
    mso-tstyle-rowband-size:0;
    mso-tstyle-colband-size:0;
    mso-style-noshow:yes;
    mso-style-priority:99;
    mso-style-qformat:yes;
    mso-style-parent:"";
    mso-padding-alt:0in 5.4pt 0in 5.4pt;
    mso-para-margin:0in;
    mso-para-margin-bottom:.0001pt;
    mso-pagination:widow-orphan;
    font-size:11.0pt;
    font-family:"Calibri","sans-serif";
    mso-ascii-font-family:Calibri;
    mso-ascii-theme-font:minor-latin;
    mso-fareast-font-family:"Times New Roman";
    mso-fareast-theme-font:minor-fareast;
    mso-hansi-font-family:Calibri;
    mso-hansi-theme-font:minor-latin;}
    (Cisco Controller) >show interface detailed management
    Interface Name................................... management
    MAC Address...................................... 88:43:e1:31:19:8b
    IP Address....................................... 172.16.10.2
    IP Netmask....................................... 255.255.255.0
    IP Gateway....................................... 172.16.10.253
    External NAT IP State............................ Disabled
    External NAT IP Address.......................... 0.0.0.0
    VLAN............................................. untagged
    Quarantine-vlan.................................. 0
    Active Physical Port............................. LAG (29)
    Primary Physical Port............................ LAG (29)
    Backup Physical Port............................. Unconfigured
    Primary DHCP Server.............................. 10.5.5.1
    Secondary DHCP Server............................ Unconfigured
    DHCP Option 82................................... Disabled
    ACL.............................................. Unconfigured
    AP Manager....................................... No
    Guest Interface.................................. No
    L2 Multicast..................................... Enabled
    core#show mac-address address 88:43:e1:31:19:8b
    Unicast Entries
    vlan   mac address     type        protocols               port
    -------+---------------+--------+---------------------+--------------------
    4001    8843.e131.198b   dynamic ip                    GigabitEthernet5/5

  • FlexVPN Cannot Ping From Spoke LAN only

    Topology:
    Hub:
    (hub lan: 10.0.1.0/24) > (lan int [ip nat inside], g0/0: 10.0.1.1) > (flex interface, loopback100: 172.31.100.1) > (flex virtual interface, Virtual-Template1: ip unnumbered loopback100) > (wan int [ip nat outside], dialer0 - g0/1) > ISP
    Spoke:
    (hub lan: 10.0.3.0/24) > (lan int [ip nat inside], vlan1: 10.0.3.1) > (flex interface, Tunnel0 ip address negotiated, tunnel source vlan 1) > (wan int, dialer0 [ip nat inside] - f0/4) > ISP
    I have full reachability from both routers. 
    Hub router can ping 172.31.100.x, 10.0.3.1 and hosts on 10.0.3.0/24 via standard ping, or extended and sourced from 10.0.1.1 or g0/0
    Spoke router can ping 172.31.100.1, 10.0.1.1 and hosts on 10.0.1.0/24 via standard ping, or extended and sourced from 10.0.3.1 or vlan1
    Partial reachability from lan hosts
    Hub hosts can ping 172.31.100.x and 10.0.3.1, but not hosts on 10.0.3.0/24 (Possibly because host cannot reply to echo request?)
    Spoke hosts cannot ping 172.31.100.1, 10.0.1.1 or hosts on 10.0.1.0/24
    Any help would be appreciated

    We've been working with these confs for a while, so they aren't as clean as they could be, but here they are
    ---HUB---
    version 15.2
    service tcp-keepalives-in
    service tcp-keepalives-out
    service timestamps debug datetime msec
    service timestamps log datetime msec
    service password-encryption
    hostname HUB
    boot-start-marker
    boot system flash:c1900-universalk9-mz.SPA.152-4.M5.bin
    boot-end-marker
    security authentication failure rate 3 log
    security passwords min-length 6
    enable secret xxxxx
    aaa new-model
    aaa group server radius FLEXVPN_AUTH-C_SERVER_GROUP
    server-private 10.0.1.15 key xxxxx
    aaa authentication login default local
    aaa authentication login xxxxxVPN_VPN_XAUTH local
    aaa authentication login FLEXVPN_AUTH-C_LIST group FLEXVPN_AUTH-C_SERVER_GROUP
    aaa authorization exec default local
    aaa authorization network default local
    aaa authorization network xxxxxVPN_VPN_GROUP local
    aaa authorization network FLEXVPN_AUTH-Z_LIST local
    aaa session-id common
    clock timezone CST -6 0
    clock summer-time CDT recurring
    clock calendar-valid
    no ip source-route
    no ip gratuitous-arps
    ip cef
    no ip bootp server
    ip domain name xxxxx.net
    ip name-server 166.102.165.13
    ip name-server 166.102.165.11
    ip name-server 8.8.8.8
    ip name-server 8.8.4.4
    ip name-server 4.2.2.1
    no ipv6 cef
    multilink bundle-name authenticated
    vpdn enable
    vpdn-group VPN_GROUP
    key chain EIGRP_KEY_CHAIN
    key 1
      key-string xxxxx
    crypto pki trustpoint FLEXVPN_RA_TP
    enrollment terminal
    serial-number none
    fqdn vpn.xxxxx.net
    ip-address none
    subject-name cn=vpn.xxxxx.net
    revocation-check crl
    eckeypair FLEXVPN_RA_TP-Key
    crypto pki certificate chain FLEXVPN_RA_TP
    certificate 460000.. nvram:xxxxx#2.cer
    certificate ca 59A43A15.. nvram:xxxxx#BC60CA.cer
    license udi pid CISCO1921/K9 sn xxxxx
    archive
    path ftp://xxxxx
    write-memory
    username xxxxx privilege 15 password xxxxx
    redundancy
    crypto ikev2 authorization policy default
    pool FLEX_SPOKES_POOL
    route set interface
    crypto ikev2 authorization policy FLEXVPN_RA_LOCAL_POLICY
    pool FLEXVPN_RA_POOL
    dns 10.0.1.15
    netmask 255.255.255.0
    def-domain xxxxx.net
    route set access-list FLEXVPN_RA_ACL
    crypto ikev2 proposal SHA1-only
    encryption aes-cbc-256
    integrity sha1
    group 5
    crypto ikev2 policy SHA1-only
    match fvrf any
    proposal SHA1-only
    crypto ikev2 keyring FLEX_KEY
    peer ALL
      address 0.0.0.0 0.0.0.0
      pre-shared-key local xxxxx
      pre-shared-key remote xxxxx
    crypto ikev2 profile FLEX_IKEv2
    match identity remote address 0.0.0.0
    authentication remote pre-share
    authentication local pre-share
    keyring local FLEX_KEY
    aaa authorization group psk list default default
    virtual-template 1
    crypto ikev2 profile FLEXVPN_RA_IKEv2_PROFILE
    match identity remote key-id xxxxx.net
    identity local dn
    authentication remote eap query-identity
    authentication local rsa-sig
    pki trustpoint FLEXVPN_RA_TP
    dpd 60 2 on-demand
    aaa authentication eap FLEXVPN_AUTH-C_LIST
    aaa authorization group eap list FLEXVPN_AUTH-Z_LIST FLEXVPN_RA_LOCAL_POLICY
    virtual-template 10
    crypto ikev2 dpd 30 5 on-demand
    ip tcp synwait-time 10
    ip ssh time-out 60
    ip ssh authentication-retries 2
    crypto logging session
    crypto isakmp client configuration group xxxxxVPN
    key xxxxx
    pool xxxxxVPN_POOL
    acl xxxxxVPN_ACL
    netmask 255.255.255.0
    crypto isakmp profile xxxxxVPN_IKE_PROFILE
       match identity group xxxxxVPN
       client authentication list xxxxxVPN_VPN_XAUTH
       isakmp authorization list xxxxxVPN_VPN_GROUP
       client configuration address respond
       virtual-template 100
    crypto ipsec transform-set xxxxxVPN_SET esp-3des esp-sha-hmac
    mode tunnel
    crypto ipsec transform-set IKEv2 esp-gcm
    mode transport
    crypto ipsec profile xxxxxVPN_IPSEC_PROFILE
    set transform-set xxxxxVPN_SET
    set isakmp-profile xxxxxVPN_IKE_PROFILE
    crypto ipsec profile FLEXVPN_RA_IPSEC_PROFILE
    set ikev2-profile FLEXVPN_RA_IKEv2_PROFILE
    crypto ipsec profile default
    set transform-set IKEv2
    set ikev2-profile FLEX_IKEv2
    interface Loopback100
    ip address 172.31.100.1 255.255.255.255
    interface Embedded-Service-Engine0/0
    no ip address
    shutdown
    interface GigabitEthernet0/0
    ip address 10.0.1.1 255.255.255.0
    no ip unreachables
    ip nat inside
    ip virtual-reassembly in
    duplex auto
    speed auto
    interface GigabitEthernet0/1
    no ip address
    duplex auto
    speed auto
    pppoe enable group global
    pppoe-client dial-pool-number 1
    interface Virtual-Template1 type tunnel
    description FlexVPN hub-to-spokes
    ip unnumbered Loopback100
    ip mtu 1400
    ip nhrp network-id 1
    ip nhrp redirect
    ip tcp adjust-mss 1360
    tunnel path-mtu-discovery
    tunnel protection ipsec profile default
    interface Virtual-Template10 type tunnel
    ip unnumbered GigabitEthernet0/0
    tunnel mode ipsec ipv4
    tunnel protection ipsec profile FLEXVPN_RA_IPSEC_PROFILE
    interface Dialer0
    mtu 1492
    ip address negotiated
    no ip unreachables
    ip nat outside
    ip virtual-reassembly in
    encapsulation ppp
    ip tcp adjust-mss 1450
    dialer pool 1
    dialer idle-timeout 0
    dialer persistent
    dialer-group 1
    ppp authentication chap pap callin
    ppp chap hostname [email protected]
    ppp chap password xxxxx
    ppp pap sent-username [email protected] password xxxxx
    no cdp enable
    router eigrp 1
    distribute-list EIGRP_SUMMARY_PFLIST out Virtual-Template1
    network 10.0.1.0 0.0.0.255
    network 172.30.200.0 0.0.0.255
    network 172.31.100.1 0.0.0.0
    passive-interface GigabitEthernet0/0
    ip local pool xxxxxVPN_POOL 172.30.255.1 172.30.255.254
    ip local pool FLEX_SPOKES_POOL 172.31.100.10 172.31.100.254
    ip local pool FLEXVPN_RA_POOL 172.30.200.1 172.30.200.254
    ip forward-protocol nd
    no ip http server
    no ip http secure-server
    ip dns server
    ip nat inside source list 1 interface Dialer0 overload
    ip route 0.0.0.0 0.0.0.0 Dialer0
    ip route 172.30.200.0 255.255.255.0 Null0
    ip access-list standard FLEXVPN_RA_ACL
    permit 10.0.1.0 0.0.0.255
    permit 10.0.2.0 0.0.0.255
    permit 10.0.3.0 0.0.0.255
    permit 10.0.4.0 0.0.0.255
    ip access-list standard MGMT_ACL
    permit 172.30.200.0 0.0.0.255
    permit 172.31.254.0 0.0.0.255
    permit 10.0.1.0 0.0.0.255
    ip access-list extended xxxxxVPN_ACL
    permit ip 172.30.255.0 0.0.0.255 any
    permit ip 10.0.1.0 0.0.0.255 any
    permit ip 172.31.254.0 0.0.0.255 any
    ip prefix-list EIGRP_SUMMARY_PFLIST seq 10 permit 10.0.1.0/24
    ip prefix-list EIGRP_SUMMARY_PFLIST seq 20 permit 172.30.200.0/24
    ip prefix-list EIGRP_SUMMARY_PFLIST seq 30 permit 172.31.100.1/32
    access-list 1 permit 10.0.1.0 0.0.0.255
    route-map EIGRP_SUMMARY_RMAP permit 10
    match ip address prefix-list EIGRP_SUMMARY_PFLIST
    control-plane
    banner motd  Cxxxxx
    line con 0
    line aux 0
    line 2
    no activation-character
    no exec
    transport preferred none
    transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
    stopbits 1
    line vty 0 4
    access-class MGMT_ACL in
    privilege level 15
    transport input telnet ssh
    line vty 5 15
    transport input all
    scheduler allocate 20000 1000
    ntp update-calendar
    ntp server 1.pool.ntp.org
    ntp server 0.pool.ntp.org prefer
    end
    ---SPOKE---
    version 15.2
    no service pad
    service tcp-keepalives-in
    service tcp-keepalives-out
    service timestamps debug datetime msec
    service timestamps log datetime msec
    service password-encryption
    hostname SPOKE
    boot-start-marker
    boot system flash:c880data-universalk9-mz.152-4.M5.bin
    boot-end-marker
    security authentication failure rate 3 log
    security passwords min-length 6
    enable secret xxxxx
    aaa new-model
    aaa authentication login default local
    aaa authorization exec default local
    aaa authorization network default local
    aaa session-id common
    memory-size iomem 10
    clock timezone CST -6 0
    clock summer-time CDT recurring
    clock calendar-valid
    no ip source-route
    no ip gratuitous-arps
    no ip bootp server
    ip domain name xxxxx.net
    ip name-server 8.8.8.8
    ip name-server 8.8.4.4
    ip name-server 4.2.2.1
    ip cef
    no ipv6 cef
    multilink bundle-name authenticated
    key chain EIGRP_KEY_CHAIN
    key 1
      key-string xxxxx
    license udi pid CISCO881-SEC-K9 sn FTX1740854N
    archive
    path ftp://xxxxx
    write-memory
    username xxxxx privilege 15 password xxxxx
    crypto ikev2 authorization policy default
    route set interface
    crypto ikev2 keyring FLEX_KEY
    peer ALL
      address 0.0.0.0 0.0.0.0
      pre-shared-key local xxxxx
      pre-shared-key remote xxxxx
    crypto ikev2 profile FLEX_IKEv2
    match identity remote address 0.0.0.0
    authentication remote pre-share
    authentication local pre-share
    keyring local FLEX_KEY
    aaa authorization group psk list default default
    virtual-template 1
    crypto ikev2 dpd 30 5 on-demand
    ip tcp synwait-time 10
    ip ssh time-out 60
    ip ssh authentication-retries 2
    crypto ipsec transform-set IKEv2 esp-gcm
    mode transport
    crypto ipsec profile default
    set transform-set IKEv2
    set ikev2-profile FLEX_IKEv2
    interface Loopback101
    ip address 172.31.101.3 255.255.255.255
    interface Tunnel0
    description FlexVPN tunnel
    ip address negotiated
    ip mtu 1400
    ip nhrp network-id 1
    ip nhrp shortcut virtual-template 1
    ip nhrp redirect
    ip tcp adjust-mss 1360
    delay 1000
    tunnel source Vlan1
    tunnel destination x.x.x.x
    tunnel path-mtu-discovery
    tunnel protection ipsec profile default
    interface FastEthernet0
    no ip address
    interface FastEthernet1
    no ip address
    interface FastEthernet2
    no ip address
    interface FastEthernet3
    no ip address
    interface FastEthernet4
    ip address dhcp
    no ip unreachables
    ip nat outside
    ip virtual-reassembly in
    duplex auto
    speed auto
    interface Virtual-Template1 type tunnel
    description FlexVPN spoke-to-spoke
    ip unnumbered Loopback101
    ip nhrp network-id 1
    ip nhrp shortcut virtual-template 1
    ip nhrp redirect
    tunnel protection ipsec profile default
    interface Vlan1
    ip address 10.0.3.1 255.255.255.0
    ip helper-address 10.0.1.15
    no ip unreachables
    ip nat inside
    ip virtual-reassembly in
    ip forward-protocol nd
    no ip http server
    no ip http secure-server
    ip dns server
    ip nat inside source list INTERNET_BOUND_ACL interface FastEthernet4 overload
    ip route 0.0.0.0 0.0.0.0 dhcp
    ip access-list standard INTERNET_BOUND_ACL
    permit 10.0.3.0 0.0.0.255
    ip access-list standard MGMT_ACL
    permit 172.30.255.0 0.0.0.255
    permit 172.31.100.0 0.0.0.255
    permit 10.0.1.0 0.0.0.255
    permit 10.0.3.0 0.0.0.255
    permit 172.30.200.0 0.0.0.255
    access-list 99 permit 10.0.3.0
    control-plane
    banner motd  xxxxx
    line con 0
    no modem enable
    line aux 0
    line vty 0 4
    access-class MGMT_ACL in
    privilege level 15
    transport input telnet ssh
    ntp update-calendar
    ntp server 0.pool.ntp.org prefer
    ntp server 1.pool.ntp.org
    end

Maybe you are looking for

  • Changes are not updated in Vistex BSP application

    Hi Friends, Iam working on VIstex BSP Applications. I have a problem with data update. I create a new Agreement Request using existing Agreement in BSP. In the Agreement Request I have different Rules and each Rule has some records in it. When I clic

  • Does anyone know how to update your e-mail in iCloud

    Does anyone know how to change your email address for iCloud? It won't let me back up without doing so

  • Anyone with the gophone plan experiencing problems with EDGE?

    I am noticing that with the gophone plan several times a day I cannot get EDGE data. I am in the bay area. I have a full signal and the E. It will keep trying to get data and then say "could not activate EDGE. Sometimes if I wait a bit it will work.

  • Solution - only productive system are displayed in DSWP

    Dear all, I have created 4 Solutions. In each solution - which has a "Productive System" as Leading Role of the Solution, only productive systems are displays when I start my DSWP transaction. Example : 1. Solution Name : Sol_ER 2. 3 logicals systems

  • Where are the ThinkStations, and where is Linux?

    Hello, I am contemplating a Lenovo TS as IBM no longer sell the Z-pro. The Z-pro appears smaller than the TS. In fact the TS appears the same size, roughly, of the X-Series. I want smaller, not larger. Honestly, if Sun could produce small sized works