CME 8 and 3945 router IOS 15.1.1 T

we are experiencing random phones that unregister with following error in log:
089919: Aug 5 15:31:18 EDT: %IPPHONE-6-UNREGISTER_ABNORMAL: ephone-60:SEP0026CBCXXXX IP:X,X.X.X Socket:168 DeviceType:Phone has unregistered abnormally.
we have been chasing our tails on this. network is saying its the router , CME team is saying its a network issue.
i did find this bug but its on a 3825 router with same IOS and CME version
http://www.ciscosystems.com/en/US/docs/ios/15_1/release/notes/151TCAVS.html
CSCth28007
Symptoms: Cisco IP phone users may experience dropped calls, resetting phones, and one-way audio.
Conditions: These symptoms are observed on a Cisco 3825 router that is running Cisco IOS Release 15.1(1)T and CME 8.0 when there are 4 or more active calls. The symptoms occur with the following topology:
Router/ PBX ---pri---- CISCO3825 ----sccp---- ip phone.
It is a normal external call: PSTN <-----> IP phone calls.
Workaround: Install Cisco IOS Release 12.4(15)XZ2 or another release earlier than Release 15.n.

I would recommend opening a TAC case and referecing the defect you think you're experiencing. You should be able to work with the assigned engineer to resolve the issue.
--Matt

Similar Messages

Site-to-Site VPN between Cisco ASA 5505 (8.4) and Cisco Router (IOS 15.2)

Hi, I'm trying to create Site-to-Site VPN between Cisco ASA 5505 and Cisco Router 3945.
I've tried create configuration with and without ASA wizard, but anyway it doesn't work.
Please help me to find where is the issue.
I have two sites and would like to get access from 192.168.83.0 to 192.168.17.0
192.168.17.0 --- S1.S1.S1.S1 (IOS Router) ==================== S2.S2.S2.S2 (ASA 5505) --- 192.168.83.0
Here is my current configuration.
Thanks for your help.
IOS Configuration
version 15.2
crypto isakmp policy 1
encr aes 256
authentication pre-share
group 2
crypto isakmp key cisco address 198.0.183.225
crypto isakmp invalid-spi-recovery
crypto ipsec transform-set AES-SET esp-aes esp-sha-hmac
mode transport
crypto map static-map 1 ipsec-isakmp
set peer S2.S2.S2.S2
set transform-set AES-SET
set pfs group2
match address 100
interface GigabitEthernet0/0
ip address S1.S1.S1.S1 255.255.255.240
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
crypto map static-map
interface GigabitEthernet0/1
ip address 192.168.17.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
duplex auto
speed auto
access-list 100 permit ip 192.168.17.0 0.0.0.255 192.168.83.0 0.0.0.255
ASA Configuration
ASA Version 8.4(3)
interface Ethernet0/0
switchport access vlan 2
interface Vlan1
nameif inside
security-level 100
ip address 192.168.83.1 255.255.255.0
interface Vlan2
nameif outside
security-level 0
ip address S2.S2.S2.S2 255.255.255.248
ftp mode passive
same-security-traffic permit intra-interface
object network inside-network
subnet 192.168.83.0 255.255.255.0
object network datacenter
host S1.S1.S1.S1
object network datacenter-network
subnet 192.168.17.0 255.255.255.0
object network NETWORK_OBJ_192.168.83.0_24
subnet 192.168.83.0 255.255.255.0
access-list outside_access_in extended permit icmp any any echo-reply
access-list outside_access_in extended deny ip any any log
access-list outside_cryptomap extended permit ip 192.168.83.0 255.255.255.0 object datacenter-network
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
ip local pool vpn_pool 192.168.83.200-192.168.83.254 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
nat (inside,outside) source dynamic inside-network interface
nat (inside,outside) source static inside-network inside-network destination static inside-network inside-network no-proxy-arp route-lookup
nat (inside,outside) source static inside-network inside-network destination static datacenter-network datacenter-network no-proxy-arp route-lookup
nat (inside,outside) source static NETWORK_OBJ_192.168.83.0_24 NETWORK_OBJ_192.168.83.0_24 destination static datacenter-network pdatacenter-network no-proxy-arp route-lookup
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 DEFAULT_GATEWAY 1
crypto ipsec ikev1 transform-set vpn-transform-set esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set vpn-transform-set mode transport
crypto ipsec ikev1 transform-set L2L_SET esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set L2L_SET mode transport
crypto dynamic-map dyno 10 set ikev1 transform-set vpn-transform-set
crypto map vpn 1 match address outside_cryptomap
crypto map vpn 1 set pfs
crypto map vpn 1 set peer S1.S1.S1.S1
crypto map vpn 1 set ikev1 transform-set L2L_SET
crypto map vpn 20 ipsec-isakmp dynamic dyno
crypto map vpn interface outside
crypto isakmp nat-traversal 3600
crypto ikev1 enable outside
crypto ikev1 policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 20
authentication pre-share
encryption aes-256
hash sha
group 2
lifetime 86400
group-policy GroupPolicy_S1.S1.S1.S1 internal
group-policy GroupPolicy_S1.S1.S1.S1 attributes
vpn-tunnel-protocol ikev1
group-policy remote_vpn_policy internal
group-policy remote_vpn_policy attributes
vpn-tunnel-protocol ikev1 l2tp-ipsec
username artem password 8xs7XK3To4s5WfTvtKAutA== nt-encrypted
username admin password rqiFSVJFung3fvFZ encrypted privilege 15
tunnel-group DefaultRAGroup general-attributes
address-pool vpn_pool
default-group-policy remote_vpn_policy
tunnel-group DefaultRAGroup ipsec-attributes
ikev1 pre-shared-key *****
tunnel-group DefaultRAGroup ppp-attributes
authentication ms-chap-v2
tunnel-group S1.S1.S1.S1 type ipsec-l2l
tunnel-group S1.S1.S1.S1 general-attributes
default-group-policy GroupPolicy_S1.S1.S1.S1
tunnel-group S1.S1.S1.S1 ipsec-attributes
ikev1 pre-shared-key *****
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
inspect icmp
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:f55f10c19a0848edd2466d08744556eb
: end

Thanks for helping me again. I really appreciate.
I don't hve any NAT-exemptions in Cisco IOS Router. Transform-set I will change soon, but I've tried with tunnel mode and it didn't work.
Maybe NAT-exemptions is the issue. Can you advice me which exemptions should be in Cisco IOS Router?
Because on Cisco ASA I guess I have everything.
Here is show crypto session detail
router(config)#do show crypto session detail
Crypto session current status
Code: C - IKE Configuration mode, D - Dead Peer Detection
K - Keepalives, N - NAT-traversal, T - cTCP encapsulation
X - IKE Extended Authentication, F - IKE Fragmentation
Interface: GigabitEthernet0/0
Session status: DOWN
Peer: 198.0.183.225 port 500 fvrf: (none) ivrf: (none)
      Desc: (none)
      Phase1_id: (none)
IPSEC FLOW: permit ip 192.168.17.0/255.255.255.0 192.168.83.0/255.255.255.0
        Active SAs: 0, origin: crypto map
        Inbound: #pkts dec'ed 0 drop 0 life (KB/Sec) 0/0
        Outbound: #pkts enc'ed 0 drop 0 life (KB/Sec) 0/0
Should I see something in crypto isakmp sa?
pp-border#sh crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
IPv6 Crypto ISAKMP SA
Thanks again for your help.

3945 Router Issue between WAAS Module and IOS Firewall

I have a new 3945 router with a SM-SRE-900 module for WAAS. The 3945 also has IP inspection configured. When IP inspection and WCCP redirection running at the same time, user connections to data center were all lost. If just IP inspection or WCC Rredirection but not both, user connections were good.
I'm feeling the problem is IP inspection not WAAS aware. I tried "ip inpsect waas enable", but the command was not available. The 3945 router, SM-SRE module, and the IOS code, are all newest versions. So I was wondering if anyone has seen the similar issues and had experience of enabling WAAS through IP inspection on those new products.
Here is the configuration info:
3945 G2 ISR: IOS 15.1(1)T1;
SM-SRE-900: WAAS 4.2.3 build7;
3945 LAN interface: ip inspection in and ip wccp 61 redirect in
3945 WAN interface: ip wccp 62 redirect in
3945 SM 1/0 interface: internal connection to SM-SRE module
Between 3945 and SM-SRE module: WCCP GRE redirection and IP Forwarding return.
If you are aware of any 15.1(1)T1 bugs that may be related, please let me know too.
Thanks for any help.

Hi,
This is in general for IOS / ISR. On CCO we have a very good document for ZBFW and WAAS intigration, see below
http://www.cisco.com/en/US/docs/ios/sec_data_plane/configuration/guide/sec_zone_polcy_firew_ps10592_TSD_Products_Configuration_Guide_Chapter.html#wp1118498
If you still need to run CBAC, then recommended solution in my first post should work for you.
If the router is in the middle of TCP optamization path, then depending upon optamization product you need to configure the firewall feature like anyother firewall. for Cisco WAAS we have "ip inspect WAAS enable".
Hope this has answer your question. Thanks.
Ahsan Khan

Information on 3945 router and ASA 5520 FW

Kindly help me.
I requested for 3945 Router, to be equipped with advanced security IOS. On delivery, it came with only one power source, and no IOS license for the security feature.. All the ones i have seen on cisco site have two power sources. The vendor is claiming that it comes with one power source by default, and that the security feature does not need any license.
Kindly confirm this to me.
Secondly, the ASA firewall has a slot meant to be occupied by a flash-like PCMCIA card, but it is empty. Asking the vendor, he says the card is embedded in the interior of the chassis. Can this be true?
I need you to help me with these clarifications.
Thank you.

Kindly help me.
I requested
for 3945 Router, to be equipped with advanced security IOS. On
delivery, it came with only one power source, and no IOS license for
the security feature.. All the ones i have seen on cisco site have two
power sources. The vendor is claiming that it comes with one power
source by default, and that the security feature does not need any
license.
Kindly confirm this to me.
Secondly, the ASA
firewall has a slot meant to be occupied by a flash-like PCMCIA card,
but it is empty. Asking the vendor, he says the card is embedded in the
interior of the chassis. Can this be true?
I need you to help me with these clarifications.
Thank you.
Hi,
If you have oredered with ios for cisco 3945 it should have pre loaded at the time of delvery and just check out the BOM at the time of order placement have order for dual power source for cisco 3945 router, As per the data sheet it has dual power supplies.
http://www.cisco.com/en/US/products/ps10541/index.html
Hope to Help !!
Ganesh.H
Remember to rate the helpful post

3945 router boots up with old IOS

I am trying to upgrade IOS on 3945 router to 152-4.M6 version. even boot system command pointing to the new IOS router still boots up with old image.
also verified the new IOS and checksum is ok. any idea why

Thanks for your reply. I have found the problem.
the model I am trying to upgrade do not support c3900-universalk9-mz.SPA.152-4.M6 rather c3900e-universalk9-mz.SPA.152-4.M6. Found the issue when testing in the lab.

HT5429 I am not able to get any directions on my maps i am using iphone 4s and updated to ios 6.1.3 and whenever i try to find a route it always says directions could not be found can anyone help in fixing it

I am not able to get any directions on my maps i am using iphone 4s and updated to ios 6.1.3 and whenever i try to find a route it always says directions could not be found can anyone help in fixing it

Maps: Turn-by-Turn Navigation
Argentina Australia Austria Belgium Brunei Bulgaria Canada Croatia Czech Republic Denmark Egypt Estonia Finland France Germany Greece Hong Kong Hungary Ireland Israel Italy Japan Latvia Liechtenstein Lithuania Luxembourg Macau Malaysia Malta Mexico Morocco Netherlands New Zealand Norway Poland Portugal Romania Russia San Marino Singapore Slovakia Slovenia South Africa South Korea Spain Sweden Switzerland Taiwan Thailand Turkey UK Ukraine USA
Back to Top

When I try to Home-Share It works most of the time. It will always show up, but sometimes I tap on the icon of my library then it wont load, I restart my computer, IOS Divice and my router It still wont load my Library .... WHY!

When I try to Home-Share It works most of the time. It will always show up, but sometimes I tap on the icon of my library then it wont load, I restart my computer, IOS Divice and my router It still wont load my library. I even went and tried to reinstall Itunes and everything nothing works.

Hi,
/Users/sarahschadek/Desktop/Safari.app/Contents/MacOS/Safari
Move the Safari app from the Desktop to the Applications folder.
Restart your Mac.
That's why you see this:
When I try to do the updates my computer says it has ready it goes through like it is downloading them then at the end it says some of the files could not be saved to "/" files.
After your restart your Mac, click the Apple  menu (top left in your screen) then click: Software Update ...
Carolyn

Site-to-site ASA and Router IOS

Hi everyone! I am trying to connect a site-to-site between an ASA and a router 3900 series. My question is what should I have to configure in the router site to protect my LAN from any external attack?
Thanks

Check the below posting...
https://supportforums.cisco.com/thread/70943
Also, make sure to allow site-to-site tunnel related ports from ASA IP only.
hth
MS

Trouble with CCME 4 and VIC2-2FXO; IOS 12.4(9)T

Trouble with CCME 4 and VIC2-2FXO; IOS 12.4(9)T
I am having trouble making outgoing call or answering incoming call.
When I try to call out from my IP 7961 phone, it fails with the message "unknown number".
For incoming call, it rings but when I pick up the call nothing happens,
Put the receiver back on hook, the phone carries on ringing. I am in UK
and just trying to set up test system with one analogue line. Any help will
be most appreciated. My config of the 2811 router is posted below. All calls ineternally works fine.
Thank you for your help.
hostname Test-CME
ip cef
no ip dhcp use vrf connected
ip dhcp excluded-address 10.10.10.1 10.10.10.10
ip dhcp excluded-address 10.139.139.1 10.139.139.10
ip dhcp pool host
network 10.10.10.0 255.255.255.0
default-router 10.10.10.1
option 150 ip 10.10.10.1
ip dhcp pool data
network 10.139.139.0 255.255.255.0
default-router 10.139.139.1
dns-server 10.139.139.5
voice-card 0
no dspfarm
voice service voip
allow-connections h323 to h323
allow-connections h323 to sip
allow-connections sip to h323
allow-connections sip to sip
supplementary-service h450.12
h323
sip
header-passing
registrar server expires max 3600 min 3600
interface FastEthernet0/1
no ip address
no ip mroute-cache
duplex auto
speed auto
no shut
interface FastEthernet0/1.2
description ** Data VLAN **
encapsulation dot1Q 2
ip address 10.139.139.1 255.255.255.0
interface FastEthernet0/1.3
description ** Voice VLAN **
encapsulation dot1Q 3
ip address 10.10.10.1 255.255.255.0
ip http server
ip http authentication local
no ip http secure-server
ip http path flash:
tftp-server flash:S00104000100.sbn
tftp-server flash:TERM41.7-0-3-0S.loads
tftp-server flash:term61.default.loads
tftp-server flash:term41.default.loads
tftp-server flash:CVM41.2-0-2-26.sbn
tftp-server flash:cnu41.2-7-6-26.sbn
tftp-server flash:Jar41.2-9-2-26.sbn
tftp-server flash:term70.default.loads
tftp-server flash:term71.default.loads
tftp-server flash:cnu70.2-7-6-26.sbn
tftp-server flash:Jar70.2-9-2-26.sbn
tftp-server flash:TERM70.7-0-3-0S.loads
tftp-server flash:CVM70.2-0-2-26.sbn
control-plane
voice-port 0/3/0
connection plar opx 202
caller-id enable
dial-peer voice 1 pots
incoming called-number .
destination-pattern 9T
port 0/3/0
telephony-service
load 7914 S00104000100
load 7941 TERM41.7-0-3-0S
load 7961 TERM41.7-0-3-0S
load 7970 TERM70.7-0-3-0S
max-ephones 20
max-dn 40
ip source-address 10.10.10.1 port 2000
calling-number initiator
service phone videoCapability 1
system message MKC CME
url services http://10.10.10.1/voiceview/common/login.do
url authentication
http://10.10.10.1/voiceview/authentication/authenticate.do
time-zone 21
date-format dd-mm-yy
voicemail 600
max-conferences 8 gain -6
call-forward pattern .T
call-forward system redirecting-expanded
moh music-on-hold.au
web admin system name admin secret 0 test
dn-webedit
time-webedit
transfer-system full-consult dss
transfer-pattern 9.T
secondary-dialtone 9
create cnf-files
ephone-dn 1 dual-line
number 201
label 201
description Sarah
name Sarah
ephone-dn 2 dual-line
number 202
label 202
description Vitthal
name User2 Vitthal
ephone-dn 3 dual-line
number 203 secondary
label 203
description Neil
name User3 Neil
ephone 1
video
username "user1" password 201
mac-address 0018.18EE.947F
type 7961 addon 1 7914
button 1:1
ephone 2
video
username "user2" password 202
mac-address 0018.18BB.B973
type 7941
button 1:2
ephone 3
video
username "user3" password 203
mac-address 0018.1885.6BA2
type 7970
button 1:3

Hi
Please find enclosed debug attachment for voice ccapi and ephone. First, I called from outside. Extension 202 rings but when I answered on extension 202 nothing happens. Replace the rceiever and the pone starts ringing again.Second step. I tried to call out by dialing 9 and then number but after a while phone displays unknown number.
Thank you for your help.
Vitthal

When my 4S connects to my home wifi, it kicks all other devices off and the router has to be restarted. Can anyone help?

I am using an iPhone 4S with 16gb memory. I did not yet update to iOS 8. I'm using 7.1.2. I have never had any problems previously using 3G or wifi. We just moved and have a new Netgear router supplied by our new ISP. We have ADSL connection. The router seems to be working fine for all the devices in the house. At any time we may have 2 or 3 laptops connected, as well as Kindle Fires, iPod Touches, and my husband's iPhone (which is the same make, model, year as mine). My iPhone will connect, but usually within minutes after connecting my iPhone 4S (though sometimes 30 minutes or more later), it kicks everyone offline and the router needs to be restarted. The router shows appropriate green lights and I can see it on my list of available networks, but if I try to connect I get the "unable to connect to this network" message until we restart the router. No one else is able to reconnect until the restart, either.
I have tried resetting network settings on my iPhone. I have completely turned off my iPhone and the router. I have talked with someone at our ISP and they did a reset of the router with me. They think the router is bad. But it works completely fine for everyone else in the house, so I can't help but think we are having a connection issue between the router and my iPhone.
Any help you can offer would be greatly appreciated! Thank you!

Is her iPhone in a case by any chance? If so, remove the case and try again. How does her iPhone work in free Wi-Fi locations?
Try resetting the iPhone...
Press and hold the Home and On/Off buttons simultaneously until you see the Apple logo, then release. This may take up to 10 seconds. This is the equivalent of a re-boot and you will not lose any data.
If none of the above work take it to an Apple store or AASP for evaluation. She will not be charged folr this and they will suggest a solution if there is a fault.

Urgent!!! Cisco ACE and asymetric routing assistance needed

I am wondering if someone can give me pointers on the cisco ACE
and asymetric routes. I've attached the diagram:
-Cisco IOS IP address is 192.168.15.4/24 and 4.1.1.4/24
-Firewall External interface is 192.168.15.1/24,
-Firewall Internal interface is 192.168.192.1/24,
-F5_BigIP External interface is 192.168.192.4/24,
-F5_BigIP Internal interface is 192.168.196.1/24 and 192.168.197.1/24,
-host_y has IP addresses of 192.168.196.10/24 and 192.168.197.10/24,
-Checkpoint has static route for 192.168.196.0/24 and 192.168.197.0/24
pointing to the F5_BigIP,
-host_y is dual-home to both VLAN_A and VLAN_B with the default
gateway on host_y pointing to VLAN_A which is 192.168.196.1,
-host_x CAN ssh/telnet/http/https to both of host_y IP addresses
of 192.168.196.10 and 192.168.197.10.
In other words, from host_x, when I try to connect to host_y
via IP address of 192.168.197.10, the traffics will go through VLAN_B
but the return traffics will go through VLAN_A. Everything
is working perfectly for me so far.
Now customer just replaces the F5_BigIP with Cisco ACE. Now,
I could not get it to work with Asymetric route with Cisco ACE. In
other words, from host_x, I can no longer ssh or telnet to host_y
via IP address of 192.168.197.10.
Anyone knows how to get asymetric route to work on Cisco ACE?
Thanks in advance.

That won't work because ACE uses the vlan id to distinguish between flows.
So when the response comes back on a different vlan, ACE can't find the flow it belongs to and it drops it.
Even if we could force it to accept the packet, ACE would then try to create a new flow for this packet and it will collide with the flow already existing on the frontend.
You would need to force your host to respond on the same vlan the traffic came in.
This could be done with client nat on ACE using different nat pool.
Gilles.

Preventing automatic download and install of iOS 8

Once again this becomes an issue. How to prevent the automatic download and installation of iOS 8. Thanks.

radellaf wrote:
This nonsense is happening right now on my iPhone. 2.3GB deleted, now iOS 8 is downloading without my consent.
That's *not* a good thing to hear.
After the download finishes, do NOT press the Install Now button. Try the following to remove the download from the device. Here's the procedure I came up with last time this happened with iOS 7...It may or may not work.
Re: Apple Forced iOS7 update on my iPad2 !
Afterwards if you succeed, block Apple's update server using the following method so it wont get pushed to the device again:
In your router's settings, set up a block (using Access Restrictions or similar in the router's web interface) to mesu.apple.com. This will prevent the devices from "phoning home" to Apple, checking for the update and getting the download pushed to it again.
Or follow the instructions at this link:
http://ios8tips.com/how-to-prevent-automatic-update-to-ios-8/

Cisco router - IOS version issue

What happend as ISP provider and provide the service but the Cisco router IOS running at low end version. Pls discuss . Thanks

Sorry, I don't understand the question. Can you please elaborate?

28561 router IOS upgrade

Hi all,
Total noob, but learning.
I bought a second hand 2851 router (CISCO2851-HSEC/K9-REF)
software:
ROM: System Bootstrap, Version 12.4(13r)T, RELEASE SOFTWARE (fc1)
I'm getting a boatload of memory fragmentation errors, then it failed to ROM image on 'unknown error'.
From what I have read from searches, all point to upgrading software.
How do I get this? How much does it cost to get to the unified version(s)?
Does the upgrade see what licenses/features I have installed and automatically enable them?
Am I allowed to use the software on the Catalyst 2960 and 3750 I have too?
And is 512MB of DRAM the max this router will take? At 256MB now.
Cruising the website is cumbersome and left me more confused then before I searched.
TIA,
Dave

Don't worry, you are in good hands, just make sure as a gesture of gratitude, please keep rating the posts which you believe have helped you :-)
"I'm getting a boatload of memory fragmentation errors, then it failed to ROM image on 'unknown error'."
This is not an encouraging news, could you please unseat the memory and put it right back and see if these err messages go away? These messages show that, some kind of either chipset issue or even worse, Motherboard issue :-(
IOS corruption may also contribute err but I have mostly seen either a crash of the Boot process or no booting at all, and the router gets stuck after the POST.
You can download IOS from the Cisco website as long as you are not using the router in production and/or for profit from a business, all you need is a valid CCO ID and a Smartnet (ESW) or UCSS contract.
That should be able to help you to download the software and use it for non production environment.
HTH

When I log onto my 2811 router (IOS Ver 12.3(8)T8 it dumps me

When I log onto my 2811 router (IOS Ver 12.3(8)T8 it dumps me into enable mode automatically. Is there a fix for this? Thanks for any help you can provide.

David
There are a couple of things that can result in the session going directly into enable mode instead of into user mode. I think the most likely one is a configuration on the vty lines which specifies privilege level. I suggest that you check the configuration of the 2811 and look under the vty lines for privilege level 15. If it is there remove it and your sessions should start in user mode.
It is also possible that if you are using aaa to authenticate and authorize that the user ID you are using has been configured to automatically give enable access. But I am guessing that the issue is the privilege level on the vty lines.
HTH
Rick

CME 8 and 3945 router IOS 15.1.1 T

Similar Messages

Maybe you are looking for