Cisco outdoor AP 1300 - OSPF multicast traffic

Hi everybody,
I have a basic question but i really do not know the answer.
So,
I want to know if i can talk OSPF through a wireless connection formed by 2 cisco aironet 1300?
I mean i am not sure if the access point is going to pass the OSPF's multicast traffic.
best regards

Duplicate post.
I'm posting my response to your other post.

Similar Messages

Cisco Catalyst 2950/2960/3750 Multicast Traffic Preference

Hello all,
we, as a student company act as an ISP for university dormitories. We would like to (if it's possible) deploy QoS to prefer multicast traffic over all other types of traffic.
Devices used in network:
Acces layer: Cisco Catalyst 2950, 12.1(22)EA14
Dristribution layer: Cisco Catalyst 2960G, 12.2(58)SE1
Core layer: Cisco Catalyst 3750G, 12.2(52)SE
Do you see any possibility to solve this with these devices? We have almost no experience with QoS, therefore any help would be greatly appreciated.
Thanks in advance.

Disclaimer
The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.
Liability Disclaimer
In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.
Posting
Hmm, I think it should be doable although the 2950s, if non-E variants, are especially weak in QoS features. I.e. those might create some issues.
With the 2960G and 3750G, you often will create problems when you enable QoS because QoS, by default, allocates its buffers resources for 4 egress queues per port rather than using all for 1 egress queue per port. However, this can be countered by QoS parameter tuning, but that takes some QoS expertize to match to your traffic and your overall QoS policy.

Cisco devices that support Multicast traffic?

Folks,
I am looking for list of Cisco devices that support Multicast traffic. Does anyone know how to get this information?
Thanks,
Nagesh

Cisco Feature Navigator

Multicast traffic flooding

Hi
We are using Network Load Balancing on some Windows 2003 servers which is configured as IGMP multicast.
The servers are connected to a 3550 SMI switch which is connected to a HP4108.
Before I configured either of these switches I connected a packet sniffer and saw the multicast traffic appearing on all ports on both switches.
I configured the HP switch as a Multicast querier and now on the 3550 I see the multicast mac addresses logged against the server ports. The 3550 also detects the muticast router as you can see:
prod-3550#sh mac-address-table mult
Vlan Mac Address Type Ports
1 0100.5e7f.4601 IGMP Fa0/10, Fa0/12, Gi0/1
1 0100.5e7f.4602 IGMP Fa0/9, Fa0/11, Gi0/1
prod-3550#
prod-3550#sh ip igmp snoo mrouter
Vlan ports
1 Gi0/1(dynamic)
The 3550 is still spamming the multicast traffic to all ports whereas the HP switch is only replicating thisto ports that are part of the multicast group.
Can anyone tell me why the 3550 is doing this or what else I need to check?
Thanks in advance.

Kate
You do not tell us much about how the 3550 is configured. From your description of the problem I am going to assume that you do not have IGMP snooping configured. This link will show you how to configure IGMP on the 3550:
http://www.cisco.com/univercd/cc/td/doc/product/lan/c3550/12225sec/3550scg/swigmp.htm
If my assumption is not correct and you do have IGMP snooping configured, then you will need to tell us more about how the 3550 is configured so we can determine why it is propagating multicast to all ports.
HTH
Rick

Cisco Outdoor Controller Based Access Point

Hi,
I am looking for Cisco Outdoor Controller Based access point model. The WLC is Cisco 2500 Series.
I have checked couple of outdoor models but all are mesh access point. I am looking for normal controller based outdoor access point ( just like controller based indoor access point models )
Thanks.

adding to Leo...
Cisco Aironet 1300 Series
http://www.cisco.com/en/US/products/ps5861/index.html
Cisco Aironet 1550 Series
http://www.cisco.com/en/US/products/ps11451/index.html
Cisco Aironet 1520 Series
http://www.cisco.com/en/US/products/ps8368/index.html
these all are Cisco OUTdoor APs.
Now u can choose as per ur req.
Regards
Dont forget to rate helpful posts

Multicast trafficis being flooded on igmp snooping enabled switch

I have two devices connected to the same switch, S streams video using multicast, H doesn't send join request, but the multicast is being sent to H, actually it is being flooded. Both hosts are in the same vlan.
Distribution-1#show ver | in WS
cisco WS-C2960-24TT-L (PowerPC405) processor (revision E0) with 65536K bytes of memory.
Model number : WS-C2960-24TT-L
* 1 26 WS-C2960-24TT-L 15.0(1)SE2 C2960-LANBASEK9-M

Duplicate post.
Go here: https://supportforums.cisco.com/discussion/12218811/multicast-trafficis-being-flooded-igmp-snooping-enabled-switch

Cisco 2960-X / Singlewire / Atlas Multicast Issues

Atlas and Singlewire are blaming the 2960-X stating that it is blocking the multicast traffic and this is why the Atlas IPS-ZCM cannot register because the SLP packets are not reaching the Singlewire server.
Already worked with Cisco TAC and they state there are no issue on the 2960-X. But based on the wiresharks from both devices, I do see the SLP request leaving the Atlas device, but I never see it hit the Singlewire server. Both devices are physically on the same switch and on the same vlan.
I have enabled and disabled IP IGMP Snooping globally with no success.
Any suggestions on a fix would be appreciated.
Atlas devices is on port 1/0/43
Singlewire is a VM running on BE6K server on port 1/0/47
=====CONFIG-=====
version 15.0
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
hostname 2960
boot-start-marker
boot-end-marker
aaa new-model
aaa session-id common
clock timezone PST -8 0
clock summer-time PST recurring
switch 1 provision ws-c2960x-48ts-l
switch 2 provision ws-c2960x-24ts-l
spanning-tree mode pvst
spanning-tree extend system-id
vlan internal allocation policy ascending
interface FastEthernet0
no ip address
no ip route-cache
interface GigabitEthernet1/0/1
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/2
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/3
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/4
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/5
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/6
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/7
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/8
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/9
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/10
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/11
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/12
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/13
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/14
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/15
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/16
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/17
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/18
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/19
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/20
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/21
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/22
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/23
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/24
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/25
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/26
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/27
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/28
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/29
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/30
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/31
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/32
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/33
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/34
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/35
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/36
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/37
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/38
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/39
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/40
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/41
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/42
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/43
description **Connects to Paging Equipment**
switchport access vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/44
description **Connects to Core Data Switch**
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/45
description **Connects to Fax Finder 440**
switchport access vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/46
description **Connects to Point to Point Between INC & Plant A**
switchport access vlan 100
interface GigabitEthernet1/0/47
description **Connects to BE6K Server Port 1**
switchport access vlan 100
spanning-tree portfast
interface GigabitEthernet1/0/48
description **Connects to INCVGW-2921 Port GE 0/0**
switchport trunk allowed vlan 1,100
switchport mode trunk
interface GigabitEthernet1/0/49
interface GigabitEthernet1/0/50
interface GigabitEthernet1/0/51
interface GigabitEthernet1/0/52
interface GigabitEthernet2/0/1
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet2/0/2
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet2/0/3
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet2/0/4
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet2/0/5
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet2/0/6
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet2/0/7
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet2/0/8
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet2/0/9
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet2/0/10
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet2/0/11
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet2/0/12
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet2/0/13
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet2/0/14
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet2/0/15
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet2/0/16
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet2/0/17
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet2/0/18
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet2/0/19
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet2/0/20
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet2/0/21
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet2/0/22
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet2/0/23
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet2/0/24
switchport voice vlan 100
spanning-tree portfast
interface GigabitEthernet2/0/25
interface GigabitEthernet2/0/26
interface GigabitEthernet2/0/27
interface GigabitEthernet2/0/28
interface Vlan1
description **DATA VLAN**
ip address 10.10.0.82 255.255.0.0
interface Vlan100
description **VOICE VLAN**
ip address 10.11.0.3 255.255.255.0
ip default-gateway 10.10.0.81
==========

Hi Leo -
So after holding the mode button down I'm not getting the option to break the prompt.
Could this mean AAA is enabled? Switches are not stacked as I thought they might be.
CPU rev: B
Image passed digital signature verification
Board rev: 5
Testing DataBus...
Testing AddressBus...
Testing Memory from 0x00000000 to 0x1fffffff.../
Using driver version 3 for media type 1
Xmodem file system is available.
Base ethernet MAC Address: 2c:3e:cf:3f:ee:80
The password-recovery mechanism is enabled.
USB EHCI 1.00
USB EHCI 1.00
USB Console INIT
Initializing Flash...
mifs[5]: 10 files, 1 directories
mifs[5]: Total bytes : 1806336
mifs[5]: Bytes used : 690688
mifs[5]: Bytes available : 1115648
mifs[5]: mifs fsck took 1 seconds.
mifs[6]: 0 files, 1 directories
mifs[6]: Total bytes : 3870720
mifs[6]: Bytes used : 1024
mifs[6]: Bytes available : 3869696
mifs[6]: mifs fsck took 0 seconds.
mifs[7]: 5 files, 1 directories
mifs[7]: Total bytes : 258048
mifs[7]: Bytes used : 8192
mifs[7]: Bytes available : 249856
mifs[7]: mifs fsck took 0 seconds.
mifs[8]: 5 files, 1 directories
mifs[8]: Total bytes : 258048
mifs[8]: Bytes used : 8192
mifs[8]: Bytes available : 249856
mifs[8]: mifs fsck took 0 seconds.
mifs[9]: 626 files, 20 directories
mifs[9]: Total bytes : 122185728
mifs[9]: Bytes used : 23478272
mifs[9]: Bytes available : 98707456
mifs[9]: mifs fsck took 29 seconds.
...done Initializing Flash.
-B

MPLS to support multicast traffic

Dear Gurus,
Does EoMPLS passes multicast traffic? Before my customer can pass multicast traffic (video) thru our Metro-Ethernet network. What we did is migrate the connection to our EoMPLS network, and then suddenly the video is not working.
Thanks.
Jeff

Hi Laurent,
Its just modulator that converts some analog videos to digital but uses multicast, the multicast data are transmiited by the modulator and received on the other end by the demod. Below is the topology
Before:
Modulator----metro-ethernet----metro-ethernet----demodulator
Current Setup:
Modulator----metro-ethernet---MPLS-ROUTER-----------------MPLS-ROUTER---metro-ethernet----demodulator
tia.

RSPAN does not put IPv6 multicast traffic into port

Hi.
There is two switches in the equation:
WS-C2960-24TT-L 12.2(55)SE5 C2960-LANBASEK9-M
and stack of
Switch Ports Model SW Version SW Image
1 12 WS-C3750G-12S 12.2(55)SE8 C3750-IPSERVICESK9-M
2 12 WS-C3750G-12S 12.2(55)SE8 C3750-IPSERVICESK9-M
* 3 24 WS-C3750G-24T 12.2(55)SE8 C3750-IPSERVICESK9-M
3 is a master
There is VTP domain with pruning off and RSPAN VLAN 1001
core#sho vlan remote-span
Remote SPAN VLANs
1001
there is RSPAN session on first:
#sho monitor session 1
Session 1
Type : Remote Source Session
Source Ports :
Both : Fa0/11
Dest RSPAN VLAN : 1001
Port Fa0/11 is in access mode, VLAN 303
and on second:
core#sho monitor session 1
Session 1
Type : Remote Destination Session
Source RSPAN VLAN : 1001
Destination Ports : Gi3/0/2
Encapsulation : Native
Ingress : Disabled
Problem is that i can't see any IPv6 multicast traffic (like ICMPv6 RA or such) on Gi3/0/2 which is absolutely sure there, because if i remove monitoring session on core switch and put Gi3/0/2 into trunk mode, i can see packets i need in vlan 1001:
# tcpdump -s0 -nnvei eth1 vlan 1001 and ip6
tcpdump: WARNING: eth1: no IPv4 address assigned
tcpdump: listening on eth1, link-type EN10MB (Ethernet), capture size 65535 bytes
14:17:37.059045 50:57:a8:f0:72:1b > 33:33:ff:00:00:01, ethertype 802.1Q (0x8100), length 90: vlan 1001, p 0, ethertype IPv6, (class 0xe0, hlim 255, next-header ICMPv6 (58) payload length: 32) 2abc:abc:1:600b::2 > ff02::1:ff00:1: [icmp6 sum ok] ICMP6, neighbor solicitation, length 32, who has 2abc:abc:1:600b::1
source link-address option (1), length 8 (1): 50:57:a8:f0:72:1b
14:17:38.083266 50:57:a8:f0:72:1b > 33:33:ff:00:00:01, ethertype 802.1Q (0x8100), length 90: vlan 1001, p 0, ethertype IPv6, (class 0xe0, hlim 255, next-header ICMPv6 (58) payload length: 32) 2abc:abc:1:600b::2 > ff02::1:ff00:1: [icmp6 sum ok] ICMP6, neighbor solicitation, length 32, who has 2abc:abc:1:600b::1
source link-address option (1), length 8 (1): 50:57:a8:f0:72:1b
14:17:39.107068 50:57:a8:f0:72:1b > 33:33:ff:00:00:01, ethertype 802.1Q (0x8100), length 90: vlan 1001, p 0, ethertype IPv6, (class 0xe0, hlim 255, next-header ICMPv6 (58) payload length: 32) 2abc:abc:1:600b::2 > ff02::1:ff00:1: [icmp6 sum ok] ICMP6, neighbor solicitation, length 32, who has 2abc:abc:1:600b::1
source link-address option (1), length 8 (1): 50:57:a8:f0:72:1b
There is no such problem with usual unicast and broadcast traffic.
Any suggestions?

Interestingly, i've found bug CSCsr64007 which i stubmbled upon on one of my switches during troubleshooting. The effect of this bug was that RSPAN took IPv6 multicast packets from unrelated VLANs and forwarded them into monitor port.
Looks like they have "fixed" it filtering IPv6 multicast completely.

Bridge Domain and multicast traffic

Hi All,
i am planning to build a Point to multipoint network based on ME3600X switch at the HQ and ISR 2900 routers at the Branches. i need to simulate a lan service.
i though of using EOMPLS at the ISR 2900 and closing them at the ME3600X. at the ME3600X i will use bridge domain to have this point to multipoint functionality.
at the configuration guide i saw that when i am using bridge domain i need to disable IGMP snooping on every Vlan.
my question is how the bridge domain treat Multicast traffic ?
furthermore, can i mix EOMPLS and Bridge Domain ?
Thanks,
Avi.

Hi Avi,
ME3600X doesn't support VPLS yet (check with your account team for the roadmap) so I don't think your design will work here. What you can do is having a router behind the ME3600X which will have a dedicated VLAN with each remote site.
HTH
Laurent.

Getting syslog from cisco 5585 how to segerate from traffic logs?

Support ,
I need some help, I want syslog from cisco asa 5585 to come to siem , but the networking guy says he can configure cisco asa 5585 to send both traffic and syslog together; there is no segerration; I don't want this to happen im just interested in getting the syslog events. In almost every firewall e.g juniper to send only traffic logs.
If its true what the networking guy says, its a very poor desgin where there is high coupling between processes;if they are dependent and one is needed to get the other what about if one thing fails?
I'm the sec guy; and I don't have the config guide about how cisco asa works at that level; i will appreciate if someone can verify or better suggest me a workaround if there exists to this issue.
Thanks.

Hi,
So you have been told that some other traffic would be also sent through the interface? That should not be the case. I dont know why the ASA would need to send any traffic to your server other than UDP/514 port traffic. If I remember correctly that is the UDP ports used.
If I would have to guess there might be a little missunderstanding between you. They might mean that they are already sending logs to some Syslos Server and the log level has been set so that the logs include all logs of connection forming through the ASA and therefore would send you very specific logs about the ASA.
The logging level set for logs that are sent to Syslog server applies to every target Syslog server. I dont think you can even specify different logging levels to different servers. But I might be mistaken.
But I am not sure what the situation is. Sounds a bit wierd.
We use a dedicated interface on ASAs to send logs to Syslog server. We might also use link for some remote management connections and monitoring.
- Jouni

Vpc bind-vrf on Nexus 7000/N7k to ensure forwarding of multicast traffic over peer-link?

In previous vPC setups with N5k (or also N6k), I had to use the 'vpc bind-vrf' command to ensure the forwarding of multicast over the vpc peer-link, especially for receivers in in non-vPC VLANs and the receivers connected to Layer 3 interfaces.
I am wondering why this command isn't available on N7k? Isn't this necessary on this platform or is it just not yet implemented?
Any hint is welcome!
Stephan Strack

Hey Stephan,
The 'vpc bind-vrf' command allocates a special internal VLAN for routing traffic over the vPC peer-link to ensure L3 connections on the vPC peer or orphan ports successfully receive multicast traffic on N5k/N6k platforms. This workaround is not needed on the N7K because that platform implements the vPC loop prevention rule differently in hardware.
In short, 'vpc bind-vrf' is not required on N7K.
-Andy

Multicast Traffic - IGMP Snooping

We are currently running a Hybrid CATOS/IOS Environment with Sup2 and MSFC2 Line Cards. The Sup Version is
8.4(3) and MSFC is 12.1(26)we want to run multicast traffic between our internal network to our external Govt Provider in the form of a particular Video Conferencing Client. We have been told that seeing we are running CATOS on our Sup2 engines we will get periodic dropouts of multicast traffic between our internal and external Depts if we don't upgrade to an Native IOS Environment. They are saying that we cannot disable igmp snooping on a per-Vlan basis under our Current Hybrid Environment unless we upgrade to Native IOS. Can we disable igmp snooping on a per-vlan basis using our current CATOS version or do we have to upgrade to a Native IOS Software set ??
Thanks Simon

at the catOS level, you only have the ability to enable igmp, not per vlan.
on the msfc SVIs you should then be able to enable or disable igmp at the VLAN interface level.
this may provide the abilities you are looking for.
try this and let us know if any further issues or post your config for review.

Cisco Outdoor 1310

We have recently purchased a Cisco 1310 outdoor device.
I have a couple of questions you may help me with please.
We have configured the device to act as an Access Point to provide VOIP (7920), however the range is not very good to provide recommended RSS.
1. What is the typical range of a 1310 acting as an AP?
2. Would it be better to assign this device bridging, backhauled onto a 1200 series AP?
3. Does anyone have some clear documentation explaining the configuration?
Many thanks in advance.

The flexibility of the device allows it to operate as an access point, wireless bridge, or workgroup bridge.Range as such cant be measured.But can be measured in relation to other access points and the data rate supported.For example For example, the range for a Cisco Aironet 1400 Series Wireless Bridge in a point-to-point link is 8.5 miles at a data rate of 54 Mbps, versus 1.5 miles at 54 Mbps for the Cisco Aironet 1300 Series (typical range with integrated antennas).Refer URL
http://www.cisco.com/en/US/products/ps5861/products_qanda_item09186a0080221971.shtml for more information

Cisco ASA 5505 Cannot ping local traffic and local hosts cannot get out

I have, what I believe to be, a simple issue - I must be missing something.
Site to Site VPN with Cisco ASA's. VPN is up, and remote hosts can ping the inside int of ASA (10.51.253.209).
There is a PC (10.51.253.210) plugged into e0/1.
I know the PC is configured correctly with Windows firewall tuned off.
The PC cannot get to the ouside world, and the ASA cannot ping 10.51.253.210.
I have seen this before, and I deleted VLAN 1, recreated it, and I could ping the local host without issue.
Basically, the VPN is up and running but PC 10.51.253.210 cannot get out.
Any ideas? Sanitized Config is below. Thanks !
ASA Version 7.2(4)
hostname *****
domain-name *****
enable password N7FecZuSHJlVZC2P encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
interface Vlan1
nameif Inside
security-level 100
ip address 10.51.253.209 255.255.255.248
interface Vlan2
nameif Outside
security-level 0
ip address ***** 255.255.255.248
interface Ethernet0/0
switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
shutdown
interface Ethernet0/3
shutdown
interface Ethernet0/4
shutdown
interface Ethernet0/5
shutdown
interface Ethernet0/6
shutdown
interface Ethernet0/7
shutdown
ftp mode passive
dns server-group DefaultDNS
domain-name *****
access-list No_NAT extended permit ip 10.51.253.208 255.255.255.248 10.1.7.0 255.255.255.0
access-list No_NAT extended permit ip 10.51.253.208 255.255.255.248 host 10.1.10.250
access-list No_NAT extended permit ip 10.51.253.208 255.255.255.248 host 10.1.3.200
access-list No_NAT extended permit ip 10.51.253.208 255.255.255.248 host 10.1.3.9
access-list No_NAT extended permit ip 10.51.253.208 255.255.255.248 host 10.10.10.14
access-list No_NAT extended permit ip 10.51.253.208 255.255.255.248 host 10.10.10.15
access-list No_NAT extended permit ip 10.51.253.208 255.255.255.248 host 10.10.10.16
access-list No_NAT extended permit ip 10.51.253.208 255.255.255.248 10.1.9.0 255.255.255.0
access-list No_NAT extended permit ip 10.51.253.208 255.255.255.248 10.10.9.0 255.255.255.0
access-list No_NAT extended permit ip 10.51.253.208 255.255.255.248 ***** 255.255.255.240
access-list Outside_VPN extended permit ip 10.51.253.208 255.255.255.248 10.1.7.0 255.255.255.0
access-list Outside_VPN extended permit ip 10.51.253.208 255.255.255.248 host 10.1.10.250
access-list Outside_VPN extended permit ip 10.51.253.208 255.255.255.248 host 10.1.3.200
access-list Outside_VPN extended permit ip 10.51.253.208 255.255.255.248 host 10.1.3.9
access-list Outside_VPN extended permit ip 10.51.253.208 255.255.255.248 host 10.10.10.14
access-list Outside_VPN extended permit ip 10.51.253.208 255.255.255.248 host 10.10.10.15
access-list Outside_VPN extended permit ip 10.51.253.208 255.255.255.248 host 10.10.10.16
access-list Outside_VPN extended permit ip 10.51.253.208 255.255.255.248 10.1.9.0 255.255.255.0
access-list Outside_VPN extended permit ip 10.51.253.208 255.255.255.248 10.10.9.0 255.255.255.0
access-list Outside_VPN extended permit ip 10.51.253.208 255.255.255.248 ***** 255.255.255.240
pager lines 24
mtu Outside 1500
mtu Inside
icmp unreachable rate-limit 1 burst-size 1
icmp permit any Outside
no asdm history enable
arp timeout 14400
global (Outside) 1 interface
nat (Inside) 0 access-list No_NAT
route Outside 0.0.0.0 0.0.0.0 ***** 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
aaa authentication enable console LOCAL
aaa authentication serial console LOCAL
aaa authentication ssh console LOCAL
http server enable
no snmp-server location
no snmp-server contact
snmp-server community *****
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set DPS_Set esp-3des esp-md5-hmac
crypto map DPS_Map 10 match address Outside_VPN
crypto map DPS_Map 10 set peer *****
crypto map DPS_Map 10 set transform-set *****
crypto map DPS_Map interface Outside
crypto isakmp enable Outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 28800
crypto isakmp policy 65535
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 Outside
ssh timeout 60
console timeout 0
management-access Inside
username test password P4ttSyrm33SV8TYp encrypted
tunnel-group ***** type ipsec-l2l
tunnel-group ***** ipsec-attributes
pre-shared-key *
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
service-policy global_policy global
prompt hostname context
Cryptochecksum:8d0adca63eab6c6c738cc4ab432f609d
: end
1500

Hi Martin,
Which way you are trying. Sending traffic via site to site is not working or traffic which you generate to outside world is not working?
But you say ASA connected interface to PC itself is not pinging that is strange. But try setting up the specific rules for the outgoing connection and check. Instead of not having any ACL.
If it is outside world the you may need to check on the NAT rules which is not correct.
If it is site to site then you may need to check few other things.
Please do rate for the helpful posts.
By
Karthik

Cisco outdoor AP 1300 - OSPF multicast traffic

Similar Messages

Maybe you are looking for