Cisco Router Forwarding External, up to 4 servers Standard & Custom MIBs

Dear Members,
One of my client need a Router and having following requirement. Other requirements meet with Cisco 2951 router.
Management/ Logging: CLI, WebUI, SNMP (v1, v2), Syslog, Forwarding External, up to 4 servers Standard & Custom MIBs, Ping, Traceroute, MPLS License included.
Please guide me what does it required saying "Forwarding External", "up to 4 servers Standard & Custom MIBs".
Regards,
Uzair Hussain

This question would be better placed in one of the Network Infrastucture sections of the focums where these things are more actively discussed than in the TelePresence section you have posted in.  I'd suggest that you move your discussion to get answers from the experts in that area.
Wayne
Please remember to rate responses and to mark your question as answered if appropriate.

Similar Messages

  • Cisco 877W router and external ADSL modem

    Cisco 877W router and external ADSL modem
    In order to support ADSL2+ on a pre ADSL2+ router and in preparation for a later migration to BT infinity I am trying to configure the Router using an external adsl2+ modem appropriately.
    The original configuration had 3 ports configured as one (internal lan) vlan and bridge group together with one wireless sub-interface, the remaining port configured a second vlan and bridge group with a second wireless sub- interface. The Dialer was a member of the second bridge group. This way the second wireless interface and associated bridge group provided a kind of DMZ for outbound access.
    The configuration I am attempting is similar the lan ports remain the same, but port 0 as a member of the vlan and bridge group (now a pppoe client) associated with one of the wireless sub interfaces as per above. The ATM interface is downed. This nearly works except that if the wireless subinterface on this bridge group is configured the dialer no longer dials giving a 'no dialer string' error. If I do not configure that wireless sub interface all works well.
    If anyone is interested to look I would appreciate any comments. I enclose a sanitised config in which you will note the 'commented out' wireless subnet interface (in red).
    version 12.4
    no service pad
    service tcp-keepalives-in
    service tcp-keepalives-out
    service timestamps debug datetime msec localtime show-timezone
    service timestamps log datetime msec localtime show-timezone
    service password-encryption
    service sequence-numbers
    hostname xxxxxxxxxxxxxxxxxxxxx
    boot-start-marker
    boot-end-marker
    logging buffered 4096 warnings
    enable secret 5 xxxxxxxxxxxxxxxxxxxxxxxxxxxx
    aaa new-model
    aaa group server radius sdm-vpn-server-group-2
    aaa group server radius rad_eap
     server 192.168.253.1 auth-port 1812 acct-port 1813
     server 192.168.253.1 auth-port 1645 acct-port 1646
    aaa group server radius rad_mac
    aaa group server radius rad_acct
    aaa group server radius rad_admin
    aaa group server tacacs+ tac_admin
    aaa group server radius rad_pmip
    aaa group server radius dummy
    aaa authentication login default local
    aaa authentication login sdm_vpn_xauth_ml_2 group sdm-vpn-server-group-2
    aaa authentication login eap_methods group rad_eap
    aaa authentication login mac_methods local
    aaa authorization exec default local
    aaa authorization ipmobile default group rad_pmip
    aaa authorization network sdm_vpn_group_ml_2 local
    aaa accounting network acct_methods start-stop group rad_acct
    aaa session-id common
    clock timezone PCTime 0
    clock summer-time PCTime date Mar 30 2003 1:00 Oct 26 2003 2:00
    crypto pki trustpoint TP-self-signed-2834265337
     enrollment selfsigned
     subject-name cn=IOS-Self-Signed-Certificate-2834265337
     revocation-check none
     rsakeypair TP-self-signed-2834265337
    crypto pki certificate chain TP-self-signed-2834265337
     certificate self-signed 01 nvram:IOS-Self-Sig#2F.cer
    dot11 syslog
    dot11 ssid GuestAP
       vlan 101
       authentication open
       authentication key-management wpa
       mbssid guest-mode
       wpa-psk ascii 7 113B162712001F4A2D2B25
    dot11 ssid LanAP
       vlan 100
       authentication open eap eap_methods
       authentication network-eap eap_methods
       authentication key-management wpa
       mbssid guest-mode
    no ip source-route
    ip cef
    no ip dhcp use vrf connected
    ip dhcp excluded-address 10.10.10.1
    ip dhcp excluded-address 192.168.252.1 192.168.252.8
    ip dhcp excluded-address 192.168.252.15 192.168.252.254
    ip dhcp pool sdm-pool1
       import all
       network 192.168.252.0 255.255.255.0
       domain-name XXX.Local
       dns-server xxx.xxx.xxx.xxx
       default-router 192.168.252.254
    ip auth-proxy max-nodata-conns 3
    ip admission max-nodata-conns 3
    no ip bootp server
    no ip domain lookup
    ip domain name XXX.Local
    ip name-server xxx.xxx.xxx.xxx
    ip name-server xxx.xxx.xxx.xxx
    ip reflexive-list timeout 120
    vpdn enable
    vpdn-group 1
     request-dialin
      protocol pppoe
    username administrator privilege 15 secret 5 £££££££££££££££££££££
    class-map type inspect match-any IN_to_OUT_CLASS
     match protocol tcp
     match protocol udp
     match protocol icmp
    class-map type inspect match-any OUT_to_IN_CLASS
     match protocol https
     match protocol smtp extended
    class-map type inspect match-any DMZ_to_IN_CLASS
     match protocol http
     match protocol https
     match protocol smtp extended
    policy-map type inspect DMZ_to_IN_POL
     class type inspect DMZ_to_IN_CLASS
      inspect
     class class-default
      drop log
    policy-map type inspect IN_to_OUT_POL
     class type inspect IN_to_OUT_CLASS
      inspect
     class class-default
      drop log
    policy-map type inspect OUT_to_IN_POL
     class type inspect OUT_to_IN_CLASS
      inspect
     class class-default
      drop log
    zone security INSIDE
    zone security OUTSIDE
    zone security DMZ
    zone-pair security OUT_TO_IN source OUTSIDE destination INSIDE
     service-policy type inspect OUT_to_IN_POL
    zone-pair security IN_TO_OUT source INSIDE destination OUTSIDE
     service-policy type inspect IN_to_OUT_POL
    zone-pair security DMZ_TO_OUT source DMZ destination OUTSIDE
     service-policy type inspect IN_to_OUT_POL
    zone-pair security DMZ_TO_IN source DMZ destination INSIDE
     service-policy type inspect DMZ_to_IN_POL
    bridge irb
    interface Loopback0
     no ip address
    interface Null0
     no ip unreachables
    interface ATM0
     no ip address
     shutdown
     no atm ilmi-keepalive
     dsl operating-mode auto
    interface FastEthernet0
     description Outside Interface (PPPoE)
    interface FastEthernet1
     description Inside Interface
     switchport access vlan 10
    interface FastEthernet2
     description Inside Interface
     switchport access vlan 10
     spanning-tree portfast
    interface FastEthernet3
     description Inside Interface
     switchport access vlan 10
     spanning-tree portfast
    interface Dot11Radio0
     no ip address
     no ip route-cache cef
     no ip route-cache
     encryption vlan 100 mode ciphers aes-ccm tkip
     encryption vlan 101 mode ciphers aes-ccm tkip
     ssid GuestAP
     ssid LanAP
     mbssid
     speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
     channel 2437
     station-role root
    interface Dot11Radio0.100
     description LanAP
     encapsulation dot1Q 100
     no ip route-cache
     no cdp enable
     bridge-group 10
     bridge-group 10 subscriber-loop-control
     bridge-group 10 spanning-disabled
     bridge-group 10 block-unknown-source
     no bridge-group 10 source-learning
     no bridge-group 10 unicast-flooding
    !interface Dot11Radio0.101
    ! description GuestAP
    ! encapsulation dot1Q 101
    ! no ip route-cache
    ! no cdp enable
    ! bridge-group 1
    ! bridge-group 1 subscriber-loop-control
    ! bridge-group 1 spanning-disabled
    ! bridge-group 1 block-unknown-source
    ! no bridge-group 1 source-learning
    ! no bridge-group 1 unicast-flooding
    interface Vlan1
     description $ES_LAN$
     no ip address
     ip virtual-reassembly
     pppoe enable group global
     pppoe-client dial-pool-number 1
     bridge-group 1
    interface Vlan10
     no ip address
     ip virtual-reassembly
     bridge-group 10
    interface Dialer1
     description $FW_OUTSIDE$
     ip address negotiated
     no ip redirects
     no ip unreachables
     no ip proxy-arp
     ip mtu 1452
     ip nat outside
     ip virtual-reassembly
     zone-member security OUTSIDE
     encapsulation ppp
     ip route-cache flow
     dialer pool 1
     dialer-group 1
     ppp authentication chap pap callin
     ppp chap hostname XXXXXXX
     ppp chap password 7 xxxxxxxxxxxxxxxxxxx
     ppp pap sent-username xxxxxxxxxxxxxxxxxx password 7 xxxxxxxxxxxxxxxxxxxxx
     ppp ipcp dns request
     ppp ipcp wins request
     hold-queue 224 in
    interface Dialer0
     no ip address
    interface BVI10
     description Inside Interface
     ip address 192.168.253.254 255.255.255.0
     ip access-group 101 in
     ip helper-address 192.168.253.1
     ip nat inside
     ip virtual-reassembly
     zone-member security INSIDE
    interface BVI1
     description DMZ Interface
     ip address 192.168.252.254 255.255.255.0
     ip nat inside
     ip virtual-reassembly
     zone-member security DMZ
    ip local pool SDM_POOL_1 192.168.20.9 192.168.20.14
    ip forward-protocol nd
    ip route 0.0.0.0 0.0.0.0 Dialer1
    ip http server
    ip http access-class 1
    ip http authentication local
    ip http secure-server
    ip http timeout-policy idle 600 life 86400 requests 10000
    ip nat inside source list Inside_Clients_NAT interface Dialer1 overload
    ip nat inside source static 192.168.253.10 xxx.xxx.xxx.xxx
    ip access-list extended DMZ_to_IN_POL
     remark SDM_ACL Category=128
     permit ip any any
    ip access-list extended Inside_Clients_NAT
     remark SDM_ACL Category=2
     permit ip 192.168.253.0 0.0.0.255 any
    logging 192.168.253.10
    access-list 1 remark Auto generated by SDM Management Access feature
    access-list 1 remark SDM_ACL Category=1
    access-list 1 permit 192.168.253.0 0.0.0.255
    access-list 100 remark VTY Access-class list
    access-list 100 remark SDM_ACL Category=1
    access-list 100 permit ip 192.168.253.0 0.0.0.255 any
    access-list 100 deny   ip any any
    access-list 101 remark Auto generated by SDM Management Access feature
    access-list 101 remark SDM_ACL Category=1
    access-list 101 remark Auto generated by SDM for NTP (123) xxx.xxx.xxx.xxx
    access-list 101 permit udp host xxx.xxx.xxx.xxx eq ntp host 192.168.253.254 eq ntp
    access-list 101 permit tcp 192.168.253.0 0.0.0.255 host 192.168.253.254 eq telnet
    access-list 101 permit tcp 192.168.253.0 0.0.0.255 host 192.168.253.254 eq 22
    access-list 101 permit tcp 192.168.253.0 0.0.0.255 host 192.168.253.254 eq www
    access-list 101 permit tcp 192.168.253.0 0.0.0.255 host 192.168.253.254 eq 443
    access-list 101 permit tcp 192.168.253.0 0.0.0.255 host 192.168.253.254 eq cmd
    access-list 101 deny   tcp any host 192.168.253.254 eq telnet
    access-list 101 deny   tcp any host 192.168.253.254 eq 22
    access-list 101 deny   tcp any host 192.168.253.254 eq www
    access-list 101 deny   tcp any host 192.168.253.254 eq 443
    access-list 101 deny   tcp any host 192.168.253.254 eq cmd
    access-list 101 deny   udp any host 192.168.253.254 eq snmp
    access-list 101 permit ip any any
    access-list 199 permit ip any host 10.1.1.1
    dialer-list 1 protocol ip permit
    no cdp run
    radius-server attribute 32 include-in-access-req format %h
    radius-server host 192.168.253.1 auth-port 1812 acct-port 1813 key 7 XXXXXXXXXXXXXXXXXX
    radius-server host 192.168.253.1 auth-port 1645 acct-port 1646 key 7 XXXXXXXXXXXXXXXXXX
    radius-server vsa send accounting
    control-plane
    bridge 1 protocol ieee
    bridge 1 route ip
    bridge 10 protocol ieee
    bridge 10 route ip
    banner login C Border Router
    line con 0
     no modem enable
     transport output telnet
    line aux 0
     transport output telnet
    line vty 0 4
     access-class 100 in
     privilege level 15
     length 0
     transport input telnet ssh
    scheduler max-task-time 5000
    scheduler interval 500
    ntp server xxx.xxx.xxx.xxx source Dialer0 prefer
    ntp server xxx.xxx.xxx.xxx source Dialer0 prefer
    sntp server xxx.xxx.xxx.xxx
    end

    Hi Jody,
    Apologies delay in replying. I have done the following:
    Made two of the FE ports vlan1,BVI1 (for LAN traffic)
    Left one port as VLAN10 as the pppoe client conected to the externalmodem
    Made the last port VLAN10 as well and gave it an IP addess as for a DMZ client.
    I have DHCP configured to serve the DMZ  addresses.
    This all works for LAN clients and also works for a client attachedto that physical DMZ port.
    When I added a dot11radio sub interface into VLAN 10 the wireless client did not get an IP lease. Everything else continued to work.
    I had never thought about this before, but if a dot11radio interface is on the same vlan (but not being part ofa bridge group) why are DHCP broadcasts not propogating to all the vlan members as I would have expected. I recognise that this isa limit in my understanding.
    If I then made VLAN10 a member of a new Bridge Group, I lost WAN connectivity as per original posting.
    I cannot add another VLAN due to the 2 vlan limit in this image.
    Finally regarding your comment about giving it what it wants, what exactly did you have in mind. The dialer already has a dial string parameters configured.
    Think I am about to give upon this.
    Regards,

  • Can't get internal vSwitch to route through external vSwitch to connect to Internet using one NIC on 2012 R2 Datacenter with Hyper-V

    I'm running into a bit of a problem here.
    I have the following two virtual switches setup on one 2012 R2 Datacenter Physical Host w/ one (1) physical NIC:
    Physical Host is running 192.168.50.120, GW: 192.168.50.1, SM: 255.255.255.0 (Cisco Router has the IP of 192.168.50.1). The Internal vSwitch Network (will contain 8 VM Servers) is 192.168.1.1. I want the VM Servers on 192.168.1.1 to be able to get Windows
    Updates by being able to route through the 192.168.50.1 vSwitch but yet, still want the Networks segregated.
    Both of these virtual switches/networks will be running through one NIC.
    I initially setup RRAS to use NAT but I'm not sure if this is the correct configuration. It seemed to work but when I went to Activate my Product Key (via MSDN Subscription) it wouldn't recognize the key and therefore I couldn't run windows updates.
    However, when I set up two of the VMs on 192.168.1.1 to use DHCP through the 192.168.50.1 Network it would work fine (i.e. DHCP, DNS and GW were all set to 192.168.50.1).
    Any ideas on what I might be doing wrong or how I could setup an effective route between the two networks?
    Any and all ideas are most welcome and appreciated.
    Sincerely,
    Wallace
    Wallace Davis

    Hi nbk5533,
    The external virtual switch and internal virtual are isolated, you must set RRAS to connect both network zone, you can refer the following article to connect the internal
    switch and external virtual switch.
    Configuring Hyper-V for multiple subnets with only one NIC (Server 2008 R2 Edition)
    http://blogs.technet.com/b/letsdothis/archive/2012/01/08/configuring-hyper-v-for-multiple-subnets-with-only-one-nic.aspx
    The similar thread:
    RRAS in VM
    http://social.technet.microsoft.com/forums/windowsserver/en-US/486bcbb4-bf01-4946-b103-cd896e9dafb9/rras-in-vm
    More information:
    http://msdn.microsoft.com/en-us/library/windows/hardware/gg605194(v=vs.85).aspx
    Hope this helps.
    We
    are trying to better understand customer views on social support experience, so your participation in this
    interview project would be greatly appreciated if you have time.
    Thanks for helping make community forums a great place.

  • How can I achieve IOS content filtering using a Cisco router

    Good day Everybody.
    I would like to set up content filtering using IOS on my Cisco router. I already know how to do URL filtering but I want to restrict access to sites based on categories.
    Is this possible without having to introduce an external device?

    Natively in IOS this is not possible. However you can configure CWS (Cisco Web Security). The router will forward web requests to a cloud based web security service.
    http://www.cisco.com/en/US/prod/collateral/vpndevc/ps10142/ps11720/data_sheet_c78-729637.html

  • Can Apple OSX server replace my Cisco router?

    I run a small business. I have 5 computers (windows) & a network printer. I have a Cisco router routing internet access to all of these computers. The router is connected to a T-1. The T-1 is to the ISP.
    What I want to do is use and apple computer with OSX server to route the internet to these computer. I also want to only allow certain websites to be accessed through the server. I may also set up a VPN. May also host a website.
    Can I do all this with OSX server? How difficult is it?
    Thanks
    Ray

    So based on what you are telling me...
    - "limited knowledge when it comes to servers and cisco routers...."
    - "the cisco has been up and running for a looong time without any problems"
    I would not recommend you change to OS X Server as your NAT router.
    To fully manage NAT on OS X Server, you need to do command-line editing for port mapping. Even with experience, I would prefer to leave that function to the router.
    I've had good luck with linksys when it comes to basic routing requirements. I'm not sure what trouble you had in the past, but for me they've been very stable and great bang for the buck.
    If you would like to block specific sites, for < $100 this router will provide NAT and a pretty decent set of firewall features:
    <a class="jive-link-external-small" href="http://">http://www.linksys.com/servlet/Satellite?childpagename=US%2FLayo ut&packedargs=c%3DLProductC2%26cid%3D1130276636538&pagename=Linksys%2FCommon%2FVisitorWrapper
    If that link doesn't work, it's model# BEFSX41
    Jeff

  • Cant ping behind cisco router (site2site vpn)

    Dears;
    After configure site to site vpn between cisco router and fortigate firewall,
    site A : 10.0.0.0/24     behind fortigate
    site B: 10.10.10.0/24  behind cisco router
    the tunnel is up and I can ping 10.0.0.1 from site B and can ping 10.10.10.1 from site A but I cant ping any ip inside 10.0.0.0/24 form site B or network 10.10.10.0/24 from site A
    my cisco router configuration is
    Current configuration : 2947 bytes
    ! No configuration change since last restart
    version 15.1
    no service pad
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    boot-start-marker
    boot-end-marker
    enable secret 4 EE103as6FtdocdBefpgugX6P9eGaDKDyBvwz7AywH5Q
    no aaa new-model
    memory-size iomem 10
    clock timezone cairo 2 0
    crypto pki token default removal timeout 0
    ip source-route
    ip dhcp excluded-address 192.168.16.1
    ip dhcp excluded-address 10.10.10.1 10.10.10.10
    ip dhcp pool GUEST
     network 192.168.16.0 255.255.255.0
     default-router 192.168.16.1
     dns-server 8.8.8.8 8.8.4.4
    ip dhcp pool LAN
     network 10.10.10.0 255.255.255.0
     default-router 10.10.10.1
     dns-server 8.8.8.8 8.8.4.4
    ip cef
    controller VDSL 0
    ip ssh version 2
    crypto isakmp policy 10
     encr aes
     hash sha256
     authentication pre-share
     group 5
    crypto isakmp key 6 *********** address 4.x.x.x no-xauth
    crypto ipsec transform-set myset esp-aes esp-sha256-hmac
    crypto map kon-map 10 ipsec-isakmp
     set peer 4.x.x.x
     set transform-set myset
     set pfs group5
     match address 105
    interface Ethernet0
     no ip address
     no fair-queue
    interface ATM0
     no ip address
     ip mtu 1452
     ip tcp adjust-mss 1452
     no atm ilmi-keepalive
    interface ATM0.1 point-to-point
     ip flow ingress
     pvc 0/35
      encapsulation aal5snap
      pppoe-client dial-pool-number 1
    interface FastEthernet0
     switchport mode trunk
     no ip address
    interface FastEthernet1
     no ip address
    interface FastEthernet2
     switchport access vlan 2
     no ip address
    interface FastEthernet3
     no ip address
    interface Vlan1
     ip address 10.10.10.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
    interface Vlan2
     ip address 192.168.16.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
    interface Dialer1
     ip address negotiated
     ip mtu 1492
     ip nat outside
     ip virtual-reassembly in
     encapsulation ppp
     ip tcp adjust-mss 1452
     dialer pool 1
     ppp authentication chap pap callin
     ppp chap hostname
     ppp chap password 0
     ppp pap sent-username
     crypto map kon-map
    ip forward-protocol nd
    no ip http server
    no ip http secure-server
    ip nat inside source list 100 interface Dialer1 overload
    ip route 0.0.0.0 0.0.0.0 Dialer1
    access-list 100 deny   ip 10.10.10.0 0.0.0.255 10.0.0.0 0.0.0.255
    access-list 100 permit ip 10.10.10.0 0.0.0.255 any
    access-list 100 permit ip 192.168.16.0 0.0.0.255 any
    access-list 105 permit ip 10.10.10.0 0.0.0.255 10.0.0.0 0.0.0.255
    banner motd ^C^C
    end
    when ping from cisco router
    konsuler#ping 10.0.0.27 source vlan1
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 10.0.0.27, timeout is 2 seconds:
    Packet sent with a source address of 10.10.10.1
    Success rate is 0 percent (0/5)
    help please

    Thank you karsten
    I can ping interface of router from remote site but cant ping any device behind the router and can ping firewall interface but cant ping any device behind the firewall
    -counters in
    # sh crypto ipsec sa
    increased only while ping 10.0.0.1 or 10.10.10.1 from both sides
    r#show crypto session detail
    Crypto session current status
    Code: C - IKE Configuration mode, D - Dead Peer Detection     
    K - Keepalives, N - NAT-traversal, T - cTCP encapsulation     
    X - IKE Extended Authentication, F - IKE Fragmentation
    Interface: Dialer1
    Uptime: 00:03:12
    Session status: UP-ACTIVE     
    Peer: 4.x.x.x port 500 fvrf: (none) ivrf: (none)
          Phase1_id: 4.x.x.x
          Desc: (none)
      IKEv1 SA: local 6.x.x.x/500 remote 4.x.x.x/500 Active
              Capabilities:(none) connid:2001 lifetime:22:39:59
      IPSEC FLOW: permit ip 10.10.10.0/255.255.255.0 10.0.0.0/255.255.255.0
            Active SAs: 2, origin: crypto map
            Inbound:  #pkts dec'ed 9 drop 0 life (KB/Sec) 4605776/3407
            Outbound: #pkts enc'ed 14 drop 0 life (KB/Sec) 4605775/3407

  • Remote access VPN with Cisco Router - Can not get the Internal Lan .

    Dear Sir ,
    I am doing Remote Access VPN through Cisco Router. Before the real deployment, I want to simulate it with GNS3.Need you help to complete the job .Please see the attachment for Scenario, Configuration and Ping status.
    I am getting IP address when i connect through VPN client .But I can not ping to the internal lan -192.168.1.0.Need your help to sole the issue.
    Below is the IP address of the device.
    Local PC connect with Router -2 (Through MS Loopback) Router -2 Router-1 PC -01
    IP Address :10.10.10.2 Mask : 255.255.255.0 F0/01
    IP address:10.10.10.1
    Mask:255.255.255.0 F0/0
    IP Address :20.20.20.1
    Mask :255.255.255.0
    F0/1
    IP address :192.168.1.3
    Mask:255.255.255.0
    F0/0
    IP address :20.20.20.2
    Mask :255.255.255.0
    F0/1
    IP address :192.168.1.1
    Mask:255.255.255.0
    I can ping from local PC to the network 10.10.10.0 and 20.20.20.0 .Please find the attach file for ping status .So connectivity is ok from my local PC to Remote Router 1 and 2.
    Through Cisco remote vpn client, I can get connected with the VPN Router R1 (Please see the VPN Client pic.)But cannot ping the network 192.168.1.0
    Need your help to fix the problem.
    Router R2 Configuration :!
    version 12.4
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname R2
    boot-start-marker
    boot-end-marker
    no aaa new-model
    memory-size iomem 5
    no ip icmp rate-limit unreachable
    ip cef
    no ip domain lookup
    ip auth-proxy max-nodata-conns 3
    ip admission max-nodata-conns 3
    ip tcp synwait-time 5
    interface FastEthernet0/0
    ip address 20.20.20.2 255.255.255.0
    duplex auto
    speed auto
    interface FastEthernet0/1
    ip address 10.10.10.1 255.255.255.0
    duplex auto
    speed auto
    ip forward-protocol nd
    no ip http server
    no ip http secure-server
    control-plane
    line con 0
    exec-timeout 0 0
    privilege level 15
    logging synchronous
    line aux 0
    exec-timeout 0 0
    privilege level 15
    logging synchronous
    line vty 0 4
    login
    end
    Router R1 Configuration :
    version 12.4
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname R1
    boot-start-marker
    boot-end-marker
    aaa new-model
    aaa authentication login USERAUTH local
    aaa authorization network NETAUTHORIZE local
    aaa session-id common
    memory-size iomem 5
    no ip icmp rate-limit unreachable
    ip cef
    no ip domain lookup
    ip auth-proxy max-nodata-conns 3
    ip admission max-nodata-conns 3
    username vpnuser password 0 strongpassword
    ip tcp synwait-time 5
    crypto keyring vpnclientskey
    pre-shared-key address 0.0.0.0 0.0.0.0 key cisco123
    crypto isakmp policy 10
    encr 3des
    hash md5
    authentication pre-share
    group 2
    crypto isakmp client configuration group remotevpn
    key cisco123
    dns 192.168.1.2
    wins 192.168.1.2
    domain mycompany.com
    pool vpnpool
    acl VPN-ACL
    crypto isakmp profile remoteclients
    description remote access vpn clients
    keyring vpnclientskey
    match identity group remotevpn
    client authentication list USERAUTH
    isakmp authorization list NETAUTHORIZE
    client configuration address respond
    crypto ipsec transform-set TRSET esp-3des esp-md5-hmac
    crypto dynamic-map DYNMAP 10
    set transform-set TRSET
    set isakmp-profile remoteclients
    crypto map VPNMAP 10 ipsec-isakmp dynamic DYNMAP
    interface FastEthernet0/0
    ip address 20.20.20.1 255.255.255.0
    ip nat outside
    ip virtual-reassembly
    duplex auto
    speed auto
    crypto map VPNMAP
    interface FastEthernet0/1
    ip address 192.168.1.1 255.255.255.0
    ip nat inside
    ip virtual-reassembly
    duplex auto
    speed auto
    ip local pool vpnpool 192.168.50.1 192.168.50.10
    ip forward-protocol nd
    ip route 10.10.10.0 255.255.255.0 FastEthernet0/0
    no ip http server
    no ip http secure-server
    ip nat inside source list NAT-ACL interface FastEthernet0/0 overload
    ip access-list extended NAT-ACL
    deny ip 192.168.1.0 0.0.0.255 192.168.50.0 0.0.0.255
    permit ip 192.168.1.0 0.0.0.255 any
    ip access-list extended VPN-ACL
    permit ip 192.168.1.0 0.0.0.255 192.168.50.0 0.0.0.255
    control-plane
    line con 0
    exec-timeout 0 0
    privilege level 15
    logging synchronous
    line aux 0
    exec-timeout 0 0
    privilege level 15
    logging synchronous
    line vty 0 4
    end

    Dear All,
    I am doing Remote Access VPN through Cisco Router. Before the real deployment, I want to simulate it with GNS3.Need you help to complete the job .
    Please see the attachment for Scenario, Configuration and Ping status. I am getting IP address when i connect through VPN client .But I can not ping to the internal lan -192.168.1.0.Need your help to sole the issue.
    Waiting for your responce .
    --Milon

  • Do you need a cisco router at remote sites when using VRF BGP?

    Hello.....
    If you could refer to the attached document and read the following... I need to know if a CISCO router is required for each of the sites.   OR does the ISP (Provider) provide the only required Router in the private cloud?
    We want to replace the Cisco 891 with a PepLink but I don't know if we can do that.  Can anyone jump in and help me understand?
    When we hear about VRF, its almost synonymous to MPLS VPN. Virtual Routing and Forwarding is commonly used by Service Providers to provide services within an MPLS cloud with multiple customers. The most interesting feature of this is that, VRF allows creation of multiple routing tables within a single router. This means that overlapping use of IP addresses from different customers is possible. Some enterprises use VRF to seggrate their services like VOIP, wireless, geographical location and other varieties.

    Whether you can replace the 891 device with another device boils down to a single question: Do you need to run BGP with the Service Provider in order to use their service. If you need to run a routing protocol with your service provider, your service is likely a L3VPN (IP VPN) solution ( i.e. you inject your site's routes into the providers L3VPN session, they use MP-BGP+VRF for segmentation within their network).
    If, however, they just drop you a L2 connection and provide L2 emulated services ( e.g. L2VPN or VPLS ) across their network, then your device can be whatever you want it to be.
    From your device's perspective, it is not VRF aware. That is, it does not know about how the service provider segments your service from another customers. In the L3VPN case, your device is routing-protocol aware. In the L2VPN case, your device is not routing protocol aware and does not need to form adjacency with the service provider's equipment.
    HTH.
    Rate if helpful.

  • Help with Remote access VPN on Cisco router 3925 via Dialer Interface

    Hi Everybody,
    I need help for my work now, I appreciate if someone can fix my problem.I have a Cisco router 3925 and access Internet via PPPoE link.  I want config VPN Remote Access and using software Cisco VPN client. But it doesn't  work.. Here my config router :
    HUNRE#show running-config
    Building configuration...
    Current configuration : 5515 bytes
    ! No configuration change since last restart
    version 15.3
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname HUNRE
    boot-start-marker
    boot-end-marker
    enable secret 5 $1$vEFw$rLfvLglzUgddCVwXDx03K.
    enable password cisco
    aaa new-model
    aaa session-id common
    crypto pki trustpoint TP-self-signed-1050416327
     enrollment selfsigned
     subject-name cn=IOS-Self-Signed-Certificate-1050416327
     revocation-check none
     rsakeypair TP-self-signed-1050416327
    crypto pki certificate chain TP-self-signed-1050416327
     certificate self-signed 01
      3082022B 30820194 A0030201 02020101 300D0609 2A864886 F70D0101 05050030
      31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
      69666963 6174652D 31303530 34313633 3237301E 170D3134 30393235 31313534
      31395A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
      4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 30353034
      31363332 3730819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
      8100CC79 74FCFABE 81183B70 5A9F4A53 EB609754 7D5F8587 9150B76E 3207A86E
      5B65F9E9 6CDAC21A 6D69221D 1FF61632 14763308 43B2A1CC 8EE5ABAC EF07530E
      3F0D35FE F08C955B 60B52B92 F8F54D53 DD6DD623 01F83493 02F9C49A F0C3483D
      3B48A008 8D96700E 88924BFE DE00201B DE5965DE 32898CAD 9012AB55 76B6F39B
      2D470203 010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603
      551D2304 18301680 14C3418C BC35F3D9 B26B2475 2BB5F826 060525AB B3301D06
      03551D0E 04160414 C3418CBC 35F3D9B2 6B24752B B5F82606 0525ABB3 300D0609
      2A864886 F70D0101 05050003 81810070 AC7C26C6 4606A551 1A3FD6C5 2A5AEAE8
      35DAC86E F8885E26 51F6EEAE 7565D3AA D532C8F3 55F6656F D103F38C 8FBDE7F1
      83E77143 76469040 7FEA41E8 14963DB3 F7F28EA0 C5F2F42C B186B75C AAB04900
      15F9CB38 A16964F5 4E7B4378 35041AA8 AE8EC181 D58D6A62 676E286A 7B9D80E6
      35A0B9FB FB76E976 3D2A19D7 006078
            quit
    ip name-server 210.245.1.253
    ip name-server 210.245.1.254
    ip cef    
    no ipv6 cef
    multilink bundle-name authenticated
    vpdn enable
    vpdn-group 1
    vpdn-group 2
    license udi pid C3900-SPE100/K9 sn FOC1823839B
    license boot module c3900 technology-package securityk9
    username cisco privilege 15 secret 5 $1$aAjB$D3iLyPFTE7O1bHPnKSJcH0
    username kdhong privilege 15 secret 5 $1$nfyX$FO1BPTabCUaE6uKQwpLT.1
    redundancy
    track 1 ip sla 1 reachability
    track 2 ip sla 2 reachability
    crypto isakmp policy 1
     encr 3des
     authentication pre-share
     group 2
    crypto isakmp client configuration group VPN-HUNRE
     key hunre
     dns 8.8.8.8
     domain hunre
     pool IP-VPN
     acl 199
     max-users 100
    crypto ipsec transform-set encrypt-method-1 esp-3des esp-sha-hmac
     mode tunnel
    crypto dynamic-map DYNMAP 1
     set transform-set encrypt-method-1
    crypto map VPN client configuration address respond
    crypto map VPN 65535 ipsec-isakmp dynamic DYNMAP
    interface Embedded-Service-Engine0/0
     no ip address
     shutdown
    interface GigabitEthernet0/0
     ip address 192.168.1.1 255.255.255.0
     ip mtu 1492
     ip nat inside
     ip virtual-reassembly in
     ip tcp adjust-mss 1412
     duplex auto
     speed auto
    interface GigabitEthernet0/1
     description FPT
     no ip address
     ip tcp adjust-mss 1412
     duplex auto
     speed auto
     pppoe enable group global
     pppoe-client dial-pool-number 1
    interface GigabitEthernet0/2
     description Connect to CMC
     no ip address
     ip mtu 1442
     ip nat outside
     ip virtual-reassembly in
     ip tcp adjust-mss 1412
     duplex auto
     speed auto
     pppoe enable group global
     pppoe-client dial-pool-number 2
     no cdp enable
    interface Dialer1
     ip address negotiated
     ip mtu 1452
     ip nat outside
     ip virtual-reassembly in
     encapsulation ppp
     dialer pool 1
     dialer-group 1
     ppp authentication chap pap callin
     ppp chap hostname [USERNAME]
     ppp chap password 0 [PASSWORD]
     ppp pap sent-username [USERNAME] password 0 [PASSWORD]
     ppp ipcp dns request
     crypto map VPN
    interface Dialer2
     description Logical ADSL Interface 2
     ip address negotiated
     ip mtu 1442
     ip nat outside
     ip virtual-reassembly in
     encapsulation ppp
     ip tcp adjust-mss 1344
     dialer pool 2
     dialer-group 2
     ppp authentication chap pap callin
     ppp chap hostname [USERNAME]
     ppp chap password 0 [PASSWORD]
     ppp pap sent-username [USERNAME] password 0 [PASSWORD]
     ppp ipcp address accept
     no cdp enable
    ip local pool IP-VPN 10.252.252.2 10.252.252.245
    ip forward-protocol nd
    ip http server
    ip http authentication local
    ip http secure-server
    ip nat inside source list 10 interface Dialer1 overload
    ip nat inside source list 11 interface Dialer2 overload
    ip nat inside source static 10.159.217.10 interface Dialer1
    ip nat inside source list 199 interface Dialer1 overload
    ip nat inside source static tcp 10.159.217.10 80 210.245.54.49 80 extendable
    ip nat inside source static tcp 10.159.217.10 3389 210.245.54.49 3389 extendable
    ip route 0.0.0.0 0.0.0.0 Dialer1
    ip route 10.159.217.0 255.255.255.0 192.168.1.8
    ip sla auto discovery
    ip sla responder
    dialer-list 1 protocol ip permit
    dialer-list 2 protocol ip permit
    access-list 10 permit any
    access-list 11 permit any
    access-list 101 permit icmp any any
    access-list 199 permit ip any any
    control-plane
    line con 0
    line aux 0
    line 2
     no activation-character
     no exec
     transport preferred none
     transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
     stopbits 1
    line vty 0 4
     password cisco
     transport input all
    line vty 5 15
     password cisco
     transport input all
    scheduler allocate 20000 1000
    ntp master
    end
    However, I cannot ping interfac Dialer 1. I using Cisco vpn client software ver 5.0.07.0290.
    Hopeful for your answers !
    Thanks

    Hi David Castro,
    Thanks for your answer,
    I configed following your guide, but it have not worked yet. I saw that I cannot ping IP gateway Internet . I using ADSL Internet and config PPPoE  and my router receive IP from ISP. Here show ip int brief :
    GigabitEthernet0/0         192.168.1.1     YES NVRAM  up                    up      
    GigabitEthernet0/1         unassigned      YES NVRAM  up                    up      
    GigabitEthernet0/2         unassigned      YES NVRAM  up                    up      
    Dialer1                    210.245.54.49   YES IPCP   up                    up      
    Dialer2                    101.99.7.73     YES IPCP   up                    up      
    NVI0                       192.168.1.1     YES unset  up                    up      
    Virtual-Access1            unassigned      YES unset  up                    up      
    Virtual-Access2            unassigned      YES unset  up                    up      
    Virtual-Access3            unassigned      YES unset  up                    up 
    But I cannot ping Interface Dialer 1, so may be VPN is does not worked. Do you have some ideal ?
    Thanks very much !

  • Cisco 1941W - with external antenna cable

    Hello guys!
    I would like to ask, maybe you know or maybe you have tried to use these cables from Cisco :
    Feature AIR-CAB020LL-R AIR-CAB050LL-R AIR-CAB100ULL-R AIR-CAB150ULL-R
    Cable Length
    20 ft (6 m)
    50 ft (15 m)
    100 ft (30 m)
    150 ft (46 m)
    Transmission Loss
    1.3 dB
    3.4 dB
    4.4 dB
    6.6 dB
    for Cisco 1941W router with external antennas?

    How far are you trying to extend the antennas? Those will work to reduce the attenuation if trying to extend the placement of the antennas. Basically they are LMR cables.
    Sent from Cisco Technical Support iPhone App

  • Trouble connecting Cisco router with cable modem for Internet purposes

    So I am requesting help from the Cisco community on this issue as the cable company states there equipment is working fine.  At all my facilities I have a guest Internet service setup through a local Internet provide to provide Internet services to the residents and guests.  I have the cable modem usually a Motorola SBG6580 or a SMC 8014 (both provided by cable company) connected to my router on a FE or GE interface.  I am using static IPs and using the cable modem just as a modem (bridge mode).  Over the past several months these connections have just stopped working.  I have not made any drastic changes to my router configs; however, the cable company has updated the firmware on these modems.  I am wondering if that could affected how the modem and router talk.  I was told by the cable company that the modem sees the Cisco router but that the port is inactive.  My router shows the port is active and traffic passing.  Does anyone have any ideas that could point where the problem lies?  I will post a basic config to one that currently does not work.  I am using a VRF to route a certain group out, using NAT.  Please let me know if I need to post additional info.  Any help would be greatly appreciated.
    Cisco CISCO2911/K9
    Version 15.2(3)T1
    service timestamps debug datetime localtime
    service timestamps log datetime localtime show-timezone
    service password-encryption
    hostname 1204RTR01
    boot-start-marker
    boot system flash0:c2900-universalk9-mz.SPA.152-3.T1.bin
    boot system flash0:c2900-universalk9-mz.SPA.151-3.T.bin
    boot-end-marker
    card type t1 0 0
    logging buffered 64000
    aaa new-model
    aaa session-id common
    clock timezone cst -6 0
    clock summer-time CDT recurring
    no ipv6 cef
    no ip source-route
    ip vrf 5
     rd 5:1
    ip multicast-routing
    1
    ip dhcp pool Guest
     vrf 5
     network 10.51.XXX.0 255.255.255.0
     default-router 10.51.XXX.XXX
     dns-server 209.18.47.61 209.18.47.62
    ip flow-cache timeout active 1
    no ip bootp server
    no ip domain lookup
    ip cef
    multilink bundle-name authenticated
    application
     global
      service alternate default
    license udi pid CISCO2911/K9 sn FTX1508AHTM
    hw-module pvdm 0/0
    redundancy
    ip tcp synwait-time 10
    interface GigabitEthernet0/0.5
     description Guest VLAN
     encapsulation dot1Q 5
     ip vrf forwarding 5
     ip address 10.51.xx.xxx 255.255.255.0
     no ip redirects
     no ip proxy-arp
     ip nat inside
     ip virtual-reassembly in
     ip tcp adjust-mss 1452
    interface GigabitEthernet0/1
     no ip address
     duplex auto
     speed auto
    interface GigabitEthernet0/2
     description Guest Intenet access
     ip vrf forwarding 5
     ip address 24.242.182.182 255.255.255.252   <--Cable company IP, Modem IP is 24.242.182.181
     ip nat outside
     ip virtual-reassembly in
     load-interval 30
     duplex auto
     speed auto
    ip forward-protocol nd
    no ip http server
    ip http authentication local
    no ip http secure-server
    ip http timeout-policy idle 60 life 86400 requests 10000
    ip nat inside source list 9 interface GigabitEthernet0/2 vrf 5 overload
    ip route vrf 5 0.0.0.0 0.0.0.0 24.242.182.181
    access-list 9 permit 10.51.204.0 0.0.0.255

    Ok, mysteriously this location just started working yesterday, but I still am dealing with seven others and I really would like to know what is going on.  I will give you everything you may need and let me know.
    Config:
    version 15.2
    no service pad
    service timestamps debug datetime localtime
    service timestamps log datetime localtime show-timezone
    service password-encryption
    hostname 1112RTR01
    boot-start-marker
    boot system flash0:c2900-universalk9-mz.SPA.152-3.T1.bin
    boot system flash0:c2900-universalk9-mz.SPA.151-1.T.bin
    boot-end-marker
    aaa new-model
    aaa session-id common
    clock timezone CDT -6 0
    clock summer-time CDT recurring
    network-clock-participate wic 0
    network-clock-select 1 T1 0/0/0
    no ipv6 cef
    no ip source-route
    ip vrf GuestVRF
     rd 5:1
    ip multicast-routing
    ip dhcp pool Guest
     vrf GuestVRF
     network 10.51.112.0 255.255.255.0
     default-router 10.51.112.1
     dns-server 209.18.47.61 209.18.47.62
    ip flow-cache timeout active 1
    no ip bootp server
    no ip domain lookup
    ip cef
    application
     global
      service alternate default
    interface Embedded-Service-Engine0/0
     no ip address
     shutdown
    interface GigabitEthernet0/0.5
     description Guest VLAN
     encapsulation dot1Q 5
     ip vrf forwarding GuestVRF
     ip address 10.51.112.1 255.255.255.0
     no ip redirects
     no ip proxy-arp
     ip nat inside
     ip virtual-reassembly in
     ip tcp adjust-mss 1452
    interface GigabitEthernet0/1
     description Guest Internet (Time Warner Connection)
     ip vrf forwarding GuestVRF
     ip address 97.77.116.234 255.255.255.252
     ip nat outside
     ip virtual-reassembly in
     load-interval 30
     duplex auto
     speed auto
    ip forward-protocol nd
    ip nat inside source list 5 interface GigabitEthernet0/1 vrf GuestVRF overload
    ip route vrf GuestVRF 0.0.0.0 0.0.0.0 97.77.116.233
    access-list 5 permit 10.51.112.0 0.0.0.255
    control-plane
    end
    router#sh ip arp vrf GuestVRF
    router#Internet  97.77.116.233           2   f80b.bee7.e09f  ARPA   GigabitEthernet0/1
    Protocol  Address          Age (min)  Hardware Addr   Type   Interface
    Internet  97.77.116.234           -   8843.e13c.8d99  ARPA   GigabitEthernet0/1
    router#ping vrf GuestVRF 97.77.116.233
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 97.77.116.233, timeout is 2 seconds:
    Success rate is 0 percent (0/5)
    router#sh int g0/1
    GigabitEthernet0/1 is up, line protocol is up
      Hardware is CN Gigabit Ethernet, address is 8843.e13c.8d99 (bia 8843.e13c.8d99)
      Description: Guest Internet (Time Warner Connection)
      Internet address is 97.77.116.234/30
      MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
         reliability 255/255, txload 1/255, rxload 1/255
      Encapsulation ARPA, loopback not set
      Keepalive set (10 sec)
      Full Duplex, 1Gbps, media type is RJ45
      output flow-control is XON, input flow-control is XON
      ARP type: ARPA, ARP Timeout 04:00:00
      Last input 00:00:00, output 00:00:00, output hang never
      Last clearing of "show interface" counters 00:00:10
      Input queue: 76/75/15/0 (size/max/drops/flushes); Total output drops: 0
      Queueing strategy: fifo
      Output queue: 0/40 (size/max)
      30 second input rate 3000 bits/sec, 7 packets/sec
      30 second output rate 0 bits/sec, 0 packets/sec
         81 packets input, 4860 bytes, 0 no buffer
         Received 81 broadcasts (0 IP multicasts)
         0 runts, 0 giants, 12 throttles
         0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
         0 watchdog, 0 multicast, 0 pause input
         16 packets output, 1193 bytes, 0 underruns
         0 output errors, 0 collisions, 0 interface resets
         0 unknown protocol drops
         0 babbles, 0 late collision, 0 deferred
         0 lost carrier, 0 no carrier, 0 pause output
         0 output buffer failures, 0 output buffers swapped out
    router#sh int g0/1
    GigabitEthernet0/1 is up, line protocol is up
      Hardware is CN Gigabit Ethernet, address is 8843.e13c.8d99 (bia 8843.e13c.8d99)
      Description: Guest Internet (Time Warner Connection)
      Internet address is 97.77.116.234/30
      MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
         reliability 255/255, txload 1/255, rxload 1/255
      Encapsulation ARPA, loopback not set
      Keepalive set (10 sec)
      Full Duplex, 1Gbps, media type is RJ45
      output flow-control is XON, input flow-control is XON
      ARP type: ARPA, ARP Timeout 04:00:00
      Last input 00:00:00, output 00:00:00, output hang never
      Last clearing of "show interface" counters 00:00:42
      Input queue: 76/75/67/0 (size/max/drops/flushes); Total output drops: 0
      Queueing strategy: fifo
      Output queue: 0/40 (size/max)
      30 second input rate 3000 bits/sec, 7 packets/sec
      30 second output rate 1000 bits/sec, 2 packets/sec
         408 packets input, 24480 bytes, 0 no buffer
         Received 408 broadcasts (0 IP multicasts)
         0 runts, 0 giants, 61 throttles
         0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
         0 watchdog, 0 multicast, 0 pause input
         72 packets output, 5669 bytes, 0 underruns
         0 output errors, 0 collisions, 0 interface resets
         0 unknown protocol drops
         0 babbles, 0 late collision, 0 deferred
         0 lost carrier, 0 no carrier, 0 pause output
         0 output buffer failures, 0 output buffers swapped out
    I am receiving packets in and out of the interface but I cannot ping the modem through the VRF.
    router#sh ip nat translations
    Pro Inside global      Inside local       Outside local      Outside global
    udp 97.77.116.234:3169 10.51.112.39:3169  209.18.47.62:53    209.18.47.62:53
    udp 97.77.116.234:8534 10.51.112.39:8534  209.18.47.61:53    209.18.47.61:53
    udp 97.77.116.234:12244 10.51.112.39:12244 209.18.47.61:53   209.18.47.61:53
    udp 97.77.116.234:14002 10.51.112.39:14002 209.18.47.61:53   209.18.47.61:53
    udp 97.77.116.234:23623 10.51.112.39:23623 209.18.47.62:53   209.18.47.62:53
    udp 97.77.116.234:24489 10.51.112.39:24489 209.18.47.61:53   209.18.47.61:53
    udp 97.77.116.234:24550 10.51.112.39:24550 209.18.47.61:53   209.18.47.61:53
    udp 97.77.116.234:27458 10.51.112.39:27458 209.18.47.62:53   209.18.47.62:53
    udp 97.77.116.234:28603 10.51.112.39:28603 209.18.47.62:53   209.18.47.62:53
    udp 97.77.116.234:37404 10.51.112.39:37404 209.18.47.62:53   209.18.47.62:53
    udp 97.77.116.234:53942 10.51.112.39:53942 209.18.47.61:53   209.18.47.61:53
    udp 97.77.116.234:58125 10.51.112.39:58125 209.18.47.62:53   209.18.47.62:53
    udp 97.77.116.234:64797 10.51.112.39:64797 209.18.47.61:53   209.18.47.61:53
    udp 97.77.116.234:56925 10.51.112.52:56925 209.18.47.61:53   209.18.47.61:53
    udp 97.77.116.234:56925 10.51.112.52:56925 209.18.47.62:53   209.18.47.62:53
    udp 97.77.116.234:62342 10.51.112.52:62342 209.18.47.62:53   209.18.47.62:53
    tcp 97.77.116.234:36559 10.51.112.69:36559 199.167.177.46:1227 199.167.177.46:1227
    tcp 97.77.116.234:48895 10.51.112.69:48895 54.195.253.126:5223 54.195.253.126:5223
    tcp 97.77.116.234:58385 10.51.112.69:58385 54.195.243.137:5223 54.195.243.137:5223
    Pro Inside global      Inside local       Outside local      Outside global
    tcp 97.77.116.234:58658 10.51.112.71:58658 31.13.66.165:443  31.13.66.165:443
    udp 97.77.116.234:3066 10.51.112.72:3066  209.18.47.62:53    209.18.47.62:53
    udp 97.77.116.234:3884 10.51.112.72:3884  209.18.47.61:53    209.18.47.61:53
    udp 97.77.116.234:6656 10.51.112.72:6656  209.18.47.61:53    209.18.47.61:53
    udp 97.77.116.234:11194 10.51.112.72:11194 209.18.47.61:53   209.18.47.61:53
    udp 97.77.116.234:11774 10.51.112.72:11774 209.18.47.62:53   209.18.47.62:53
    Let me know if you need anything else.  I need to figure this out and I just don't get it because the other site wasn't working a few days ago and all of a sudden it is working again but others are still not.

  • SRX Using DHCP on UNTRUST (BRANCH)-- Connected to Static VTI Cisco Router (HQ)

    Good morning Gentlemen, I need some advice.  I am primarily a cisco IOS chap, but have recently been delving into some JUNOS action.
    I cannot find an example on the Juniper Forums/Documentation or the Cisco Forums/Documentation to my specific Issue.
    Firstly, I am not interested in Policy Based VPNs.   I do not know if it is possible to use a DHCP assigned public address on remote device with a "static VTI" - when using IKE identities. However as Phase one is up, I think the issue is more to do with Phase2 proposals when not explicitly defining a Tunnel destination.
    In the scenario I am trying to sort now, I have an SRX-100 device, that gets its public address from a DHCP server.
    I have back at the HQ, a cisco router.  
    The Cisco router has various VTI tunnels out to other branch devices, that are smaller Cisco routers. These VTI tunnels are working fine - note all using static Public IP's 
    I have my phase1 up fine, (from both sides' perspective) and am sending a local-identity hostname instead of a defining a destination address on the Tunnel on the cisco side.
    JUNIPER
    Index State Initiator cookie Responder cookie Mode Remote Address
    5048723 UP 41ee08a4a0fde661 517176fea0f23989 Aggressive 4.4.4.4
    CISCO
    IPv4 Crypto ISAKMP SA
    dst src state conn-id status
    4.4.4.4 1.1.1.1 QM_IDLE 1110 ACTIVE NICK-SRX-ISAKMP-PROFILE
    A working VTI tunnel has an SA of : (cisco perspecive)
    local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
    remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
    I have tried sending this as the proxy-id on the Juniper to no avail.
    The error is still :
    *Jun 6 10:20:07.244: ISAKMP1110):atts are acceptable.
    IPSec policy invalidated proposal with error 64
    *Jun 6 10:20:07.244: ISAKMP1110): phase 2 SA policy not acceptable!
    The IPSEC transform-Set attributes are accepted though,
    transform 0, ESP_3DES
    *Jun 6 10:20:07.244: ISAKMP: attributes in transform:
    *Jun 6 10:20:07.244: ISAKMP: authenticator is HMAC-SHA
    *Jun 6 10:20:07.244: ISAKMP: SA life type in seconds
    *Jun 6 10:20:07.244: ISAKMP: SA life duration (VPI) of 0x0 0x0 0xE 0x10 
    *Jun 6 10:20:07.244: ISAKMP: SA life type in kilobytes
    *Jun 6 10:20:07.244: ISAKMP: SA life duration (VPI) of 0x0 0x46 0x50 0x0 
    *Jun 6 10:20:07.244: ISAKMP: encaps is 1 (Tunnel)
    *Jun 6 10:20:07.244: ISAKMP1110):atts are acceptable.
    So it is something to do with the SA/Proxy ID's being sent.
    here is the Juniper Config:
    proposal IKE-SHA-AES128-DH2 {
    authentication-method pre-shared-keys;
    dh-group group2;
    authentication-algorithm sha1;
    encryption-algorithm aes-128-cbc;
    lifetime-seconds 86400;
    policy IKE-POLICY-HQ {
    mode aggressive;
    proposals IKE-SHA-AES128-DH2;
    pre-shared-key ascii-text "secretkey";
    gateway IKE-GATEWAY {
    ike-policy IKE-POLICY-HQ;
    address 4.4.4.4;
    local-identity hostname knuckles.net;
    external-interface fe-0/0/0.0;
    proposal HQ-IPSEC-PROPOSAL {
    protocol esp;
    authentication-algorithm hmac-sha1-96;
    encryption-algorithm 3des-cbc;
    lifetime-seconds 3600;
    lifetime-kilobytes 4608000;
    policy HQ-IPSEC-POLICY {
    proposals HQ-IPSEC-PROPOSAL;
    vpn ROUTE-BASED-VPN-TO-HQ {
    bind-interface st0.0;
    ike {
    gateway IKE-GATEWAY;
    ipsec-policy HQ-IPSEC-POLICY;
    establish-tunnels immediately;
    st0 {
    unit 0 {
    family inet {
    address 10.1.1.2/30;
    CISCO SIDE:
    crypto isakmp policy 2
    encr aes
    authentication pre-share
    group 2
    crypto keyring NICK-SRX 
    pre-shared-key hostname knuckles.net key secretkey
    crypto isakmp profile NICK-SRX-ISAKMP-PROFILE
    keyring default
    keyring NICK-SRX
    match identity host knuckles.net
    initiate mode aggressive
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac 
    mode tunnel
    crypto ipsec profile NICK-SRX-IPSEC-PROFILE
    set transform-set ESP-3DES-SHA 
    set isakmp-profile NICK-SRX-ISAKMP-PROFILE
    interface Tunnel1
    description HQ to NC-SRX
    ip address 10.1.1.1 255.255.255.252
    tunnel source 4.4.4.4
    tunnel mode ipsec ipv4
    tunnel destination dynamic
    tunnel protection ipsec profile NICK-SRX-IPSEC-PROFILE
    FYI - If I use the Provider given DHCP address on the Cisco Tunnel config, as a destination - the tunnel comes up immediately....So ' thinking this may be a limitation of static VTI. I have not tested the IKE identity on a remote cisco router also using VTI yet. 
    e.g.
    interface Tunnel1
    description HQ to NC-SRX
    ip address 10.1.1.1 255.255.255.252
    tunnel source 4.4.4.4
    tunnel mode ipsec ipv4
    tunnel destination 1.1.1.1
    tunnel protection ipsec profile NICK-SRX-IPSEC-PROFILE
    So I guess my question is Is this possible using a static VTI?
    What does this comand do - does it turn on dynamic VTI (all that virtual-template business)- or just tell the tunnel to expect and IKE identity?
    tunnel destination dynamic
    Does Dynamic VTI work with Different Vendors, and if so how can you control what VRF is assigned to the tunnels - I will need in the future multiple VRF's for each branch device, some using DHCP public addresses.
    The VTI design guide does not mention Identity IKE for branch sites without using dynamic VTI.  
    I would like to avoid using the whole easyVPN / dynamic VTI, as I need to use multiple VRF;s on the endpoints.

    Perhaps this fellow has cracked it - is this the only way ???
    https://supportforums.cisco.com/document/58076/dynamic-ip-dynamic-ip-ipsec-vpn-tunnel

  • CISCO IP 7961G / External Speaker for Hard of Hearing

    I have a customer that wants an external speaker installed on a 7961G telephone. Can this be done via the AUX jack on the telephone? If so, where can it be purchased with installation instructions.

    You can plug a PC-compatible powered speaker into the 3.5 mm Speaker jack on
    the left side of the phone. External speakers can enhance the quality of the sound
    that you hear from your phone.
    To use an external speaker, you must configure the appropriate setting on the
    Speakers menu on the phone
    (choose Settings > User Preferences > Audio
    Preferences > Speakers). For more information, refer to the Help available on the phone via the ? button.
    Cisco recommends the following guidelines for external devices though:
    The following information applies when you use external devices with the Cisco
    IP Phone:
    Cisco recommends the use of good quality external devices (speakers, microphones, and headsets) that are screened against unwanted radio frequency(RF) and audio frequency (AF) signals.
    Depending on the quality of these devices and their proximity to other devices such as mobile phones or two-way radios, some audio noise may still occur. In these cases, Cisco recommends that you take one or more of the following actions:
    • Move the external device away from the source of the RF or AF signals.
    • Route the external device cables away from the source of the RF or AF
    signals.
    • Use screened cables for the external device, or use cables with a better screen
    and connector.
    • Shorten the length of the external device cable.
    • Apply ferrites or other such devices on the cables for the external device.
    Cisco cannot guarantee the performance of the system because Cisco has no
    control over the quality of external devices, cables, and connectors. The system
    will perform adequately when suitable devices are attached using good quality
    cables and connectors.
    These speakers can be purchased at any decent shop or via your reseller...
    Please rate post...

  • Setting PPPoE clients speed Via Cisco router

    Hi i have a 7200 cisco router working as NAS (network access server) for PPPoE sessions , the clients connected DSLAMS and the Cisco connected to an AAA external Raduis server.
    i want to set the user speed Via cisco router in a way which can be controlled in the Radius server , and not through the actual speed of the DSLAMS ports
    Thanks alot

    Hello Mohamed,
    there is a feature called controlled subscriber bandwidth that may fit your needs:
    see
    http://www.cisco.com/en/US/docs/ios/bbdsl/configuration/guide/bba_con_sub_bdwth_ps6441_TSD_Products_Configuration_Guide_Chapter.html
    it manipulates the ATM traffic parameters on a per user basis
    these settings can be done on radius AV:
    example:
    The following example shows how to configure RADIUS attributes for a user profile for DBS:
    [email protected] Password = "userpassword1", Service-Type = Outbound
         Service-Type = Outbound,
         Cisco-Avpair = "vpdn:tunnel-id=tunnel33",
         Cisco-Avpair = "vpdn:tunnel-type=l2tp",
         Cisco-Avpair = "vpdn:l2tp-tunnel-password=password2",
         Cisco-Avpair = "vpdn:ip-addresses=172.16.0.0",
         Cisco-Avpair = "atm:peak-cell-rate=155000",
         Cisco-Avpair = "atm:sustainable-cell-rate=155000"
    Hope to help
    Giuseppe

  • New VLAN config on Cisco router

    We are in the process of rolling out VOIP with new Cisco router
    configurations. When the VLAN config is changed on the router it can no
    longer ping the server. The router config is setup with secondary IP info
    so that we don't have to go thru the process of changing IP config on the
    NW 6.5 SP 6 servers.
    Has anyone seen this issue? Do I need to bind new VLAN ti IP NICs? Any
    other thoughts?
    Thanks for any help received,
    Todd W Carter

    On 6/5/2007 Todd W Carter wrote:
    > We are in the process of rolling out VOIP with new Cisco router
    > configurations. When the VLAN config is changed on the router it can no
    > longer ping the server. The router config is setup with secondary IP info so
    > that we don't have to go thru the process of changing IP config on the NW 6.5
    > SP 6 servers.
    >
    > Has anyone seen this issue? Do I need to bind new VLAN ti IP NICs? Any other
    > thoughts?
    When pinging from the router, the packets will be source from its primary
    ip address. If the server's subnet is part of the secondary IP address on the
    router, you must use an extended ping in the router for it to work.
    However, I recommend implementing router-in-a-stick instead of secondary IP
    addressing when creating multiple VLANs.
    On the router, you can create sub-interfaces under the LAN interface and deploy
    dot1q trunking. At the switch-port, configure dot1q trunking as well and the
    router
    will route between VLANs while providing a better design.
    This is outside of the scope of this forum so I recommend posting in the Cisco
    forums at http://forum.cisco.com/eforum/servlet/NetProf?page=main
    Thanks !
    Edison Ortiz
    (Routing & Switching, CCIE # 17943)

Maybe you are looking for