Configuring PAT/NAT in cisco routers
hello, first sorry for my bad english
i just wanted to know how configuring PAT (port address translation)
like this :?
amir(config)#ip nat inside source static tcp 192.168.1.1 1000 172.16.1.1 1000
or not?
2nd question i have is:
when i need to write: "ip nat inside source"... and when i need to write "ip nat outside" ..
and the last question for now is:
how i can (if that's possible) to configure dynamic PAT - I mean that any computer on my LAN will go out to the internet with the same address but with diffrent ports - in random mode.(i mean without configuring static one by one)
i hope i was clear enough, tanks a lot!
Hi Tiger,
1) Yes your first statement is a static PAT statement which will say source ip with source port 1000 is translated to 172.16.1.1 with same port number but yes it is a static PAT entry.
2) Coming to your 2nd question
"ip nat inside source" is a global config command which says any traffic which hits the inside interface nat the source ip address.
"ip nat inside" is a interface mode command which should be done going to any interface. This command specifies which will be an inside interface which will nat the incoming traffic.
3) Coming to your last question
For dynamic PAT you just need to configure overload command at the end of your nat statement.
This link will give you a very broad and nice picture of how NAT can be configured in different situation
http://www.cisco.com/warp/public/556/12.html#6
HTH
Ankur
Similar Messages
-
Configuring PAT for VoIP got a Turn Up today!!!
Good Morning all,
I have a question, I've researched around the internet to find the CLI commands to open ports TCP 5060/5061 and UDP ports 1024 to 65535 to my SIP provider. I'm a voice guy so i'm VERY new to Security and I would like some assistance.
I'm using a ASA 5505, and below is my Show Run:
------------------ show running-config ------------------
: Saved
ASA Version 8.3(2)
hostname ECSASA-5505
domain-name hostedatandvoice.local
enable password <removed>
passwd <removed>
names
interface Vlan1
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
interface Vlan2
nameif outside
security-level 0
ip address x.x.x.x 255.255.255.252
interface Ethernet0/0
description COMCAST
switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
banner exec EnterCloud Solutions ASA
banner login AAA is enabled, Local access has been restricted to local Administrators and Engineers of ECS, LLC.
banner motd EnterCloud Solutions ASA Applicance. Unauthorized users will be logged and flagged for unauthorized access. IP's are tracked and logged and will be reported to local State and Federal agencies.
banner motd Contact [email protected] for additional help or support.
banner asdm WELCOME TO ECS ASA 5505 SECURITY APPLICANCE!
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
dns server-group DefaultDNS
domain-name hostedatandvoice.local
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network Internet
subnet 0.0.0.0 0.0.0.0
object network obj_any
subnet 0.0.0.0 0.0.0.0
object service NTP
service tcp source eq 123 destination eq 123
description Time Clock
object network STATIC-PAT
subnet 192.168.1.0 255.255.255.0
object network VPN-Pool
subnet 190.168.10.0 255.255.255.240
description VPN IP Address
object network SSL-VPN-POOL
description SSL-VPN-POOL
object network SSL-VPN-POOL1
object network SSL-VPN-NET1
subnet 192.168.10.0 255.255.255.240
object network outside_to_inside_VoIP
host 192.168.1.8
object-group network PRIVATE-LAN
network-object 192.168.1.0 255.255.255.0
object-group network SSL-VPN-NETWORKS
description SSL VPN NETWORKS
object-group network VPN-NETWORK
network-object object SSL-VPN-NET1
access-list OUTSIDE-IN extended permit udp any object STATIC-PAT eq ntp
access-list ECSSLVPN remark Allow VPN Access to LAN
access-list ECSSLVPN standard permit 192.168.1.0 255.255.255.0
pager lines 24
logging enable
logging buffer-size 1000000
logging buffered debugging
logging asdm debugging
mtu inside 1500
mtu outside 1500
ip local pool VPN-Pool 192.168.10.1-192.168.10.12 mask 255.255.255.240
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
icmp permit any outside
asdm image disk0:/asdm-712.bin
no asdm history enable
arp timeout 14400
nat (inside,outside) source static PRIVATE-LAN PRIVATE-LAN destination static VPN-NETWORK VPN-NETWORK
object network STATIC-PAT
nat (inside,outside) dynamic interface
route outside 0.0.0.0 0.0.0.0 x.x.x.x1
route inside 192.168.10.0 255.255.255.255 192.168.1.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication ssh console LOCAL
aaa authentication http console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 inside
http 0.0.0.0 0.0.0.0 outside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
crypto ca trustpoint ASDM_TrustPoint0
enrollment self
email [email protected]
subject-name CN=ESCASA-5505
ip-address x.x.x.x
keypair ECS-KP
proxy-ldc-issuer
crl configure
crypto ca trustpoint ASDM_TrustPoint1
enrollment terminal
crl configure
crypto ca certificate chain ASDM_TrustPoint0
certificate 59203f51
308202a8 30820211 a0030201 02020459 203f5130 0d06092a 864886f7 0d010105
05003066 31143012 06035504 03130b45 53434153 412d3535 3035314e 301b0609
2a864886 f70d0109 08130e35 302e3139 342e3234 352e3138 35302f06 092a8648
86f70d01 09021622 45534341 53412d35 3530352e 686f7374 65646174 616e6476
6f696365 2e6c6f63 616c301e 170d3133 30333132 31333233 34375a17 0d323330
33313031 33323334 375a3066 31143012 06035504 03130b45 53434153 412d3535
3035314e 301b0609 2a864886 f70d0109 08130e35 302e3139 342e3234 352e3138
35302f06 092a8648 86f70d01 09021622 45534341 53412d35 3530352e 686f7374
65646174 616e6476 6f696365 2e6c6f63 616c3081 9f300d06 092a8648 86f70d01
01010500 03818d00 30818902 818100dd 432f3bbc 24f0329f 81f0faea 27555dd6
972dfcc0 697dd74b 8ebdfe7a b7adb611 a97b3881 baef9373 d6442571 7da6d0b1
f74e9ff9 6602d832 6a092719 2460ecb1 0088a4f0 fbf0c2b0 13586c87 c23d69b2
08525422 f66e735c 46f3b3c8 d3f41c21 5a204fea cd798c7b e15c018a 6f6d344d
de24ac87 12cc69a7 b07023a4 302a0702 03010001 a3633061 300f0603 551d1301
01ff0405 30030101 ff300e06 03551d0f 0101ff04 04030201 86301f06 03551d23
04183016 80149724 66a81b45 e402da6f f9e47a87 6c01af08 5476301d 0603551d
0e041604 14972466 a81b45e4 02da6ff9 e47a876c 01af0854 76300d06 092a8648
86f70d01 01050500 03818100 517b691a 285b035e 5e4ffaba 02467a5a 45d1d4fd
0e39838d caf77bf1 4cc2f5a6 2fefb926 d0a2fdc4 ebabc75a 28380c06 60df23ee
8be72ddc b3587956 1eb1df89 d7b4293a ad0db500 bf651885 0a44ba2c 4b94f8ce
e27b8242 4abead6b a1af0468 5ed4a8ef 013f2d08 59df2f2e e6afcc21 2df6bbd0
a1f15a01 4ba8960a ec9771bb
quit
crypto isakmp enable outside
crypto isakmp policy 10
authentication crack
encryption aes-256
hash sha
group 2
lifetime 86400
crypto isakmp policy 20
authentication rsa-sig
encryption aes-256
hash sha
group 2
lifetime 86400
crypto isakmp policy 30
authentication pre-share
encryption aes-256
hash sha
group 2
lifetime 86400
crypto isakmp policy 40
authentication crack
encryption aes-192
hash sha
group 2
lifetime 86400
crypto isakmp policy 50
authentication rsa-sig
encryption aes-192
hash sha
group 2
lifetime 86400
crypto isakmp policy 60
authentication pre-share
encryption aes-192
hash sha
group 2
lifetime 86400
crypto isakmp policy 70
authentication crack
encryption aes
hash sha
group 2
lifetime 86400
crypto isakmp policy 80
authentication rsa-sig
encryption aes
hash sha
group 2
lifetime 86400
crypto isakmp policy 90
authentication pre-share
encryption aes
hash sha
group 2
lifetime 86400
crypto isakmp policy 100
authentication crack
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp policy 110
authentication rsa-sig
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp policy 120
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp policy 130
authentication crack
encryption des
hash sha
group 2
lifetime 86400
crypto isakmp policy 140
authentication rsa-sig
encryption des
hash sha
group 2
lifetime 86400
crypto isakmp policy 150
authentication pre-share
encryption des
hash sha
group 2
lifetime 86400
crypto isakmp policy 65535
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
no crypto isakmp nat-traversal
telnet timeout 5
ssh 192.168.1.0 255.255.255.0 inside
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 5
console timeout 0
dhcpd dns 4.2.2.2 8.8.1.1
dhcpd domain hostedatandvoice.local
dhcpd address 192.168.1.12-192.168.1.130 inside
dhcpd dns 4.2.2.2 8.8.1.1 interface inside
dhcpd domain hostedatandvoice.com interface inside
dhcpd enable inside
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ntp server 199.249.224.123 source outside prefer
ssl trust-point ASDM_TrustPoint0 outside
webvpn
enable outside
svc image disk0:/anyconnect-win-3.0.11042-k9.pkg 1
svc image disk0:/anyconnect-macosx-i386-3.1.02040-k9.pkg 2
svc enable
group-policy DfltGrpPolicy attributes
dns-server value 4.2.2.2
vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
split-tunnel-policy tunnelspecified
split-tunnel-network-list value ECSSLVPN
default-domain value hostedatandvoice.local
split-dns value hostedatandvoice.com
address-pools value VPN-Pool
webvpn
svc ask enable default webvpn
username khayes password <removed> privilege 15
username mharrell password <removed> privilege 15
username bdillard password <removed> privilege 15
username skonti password <removed> privilege 15
tunnel-group ECSSLVPN type remote-access
tunnel-group ECSSLVPN general-attributes
address-pool VPN-Pool
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect ip-options
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
service-policy global_policy global
prompt hostname context
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email [email protected]
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:977f2a92875a8c744753124c94adbb09
: endKenneth,
If that's the case you can use a range of port and create a NAT using your outside interface IP.
object network CUCM_Private
host 10.10.10.10
object service Range_1024_65535
service udp source range 1024 65535
object service SIP_range
service tcp source range 5060 5061
nat (inside,outside) source static CUCM_Private interface service Range_1024_65535 Range_1024_65535
nat (inside,outside) source static CUCM_Private interface service SIP_range SIP_range
access-list outside_access_in permit tcp any object CUCM_Private eq 5060
access-list outside_access_in permit tcp any object CUCM_Private eq 5061
access-list outside_access_in permit tcp any object CUCM_Private range 1024 65535
Take in consideration that I am using different IP address, please use the correponding IP's.
Hope it helps,
Juan Lombana -
Difference between setting up a vpn with windows 7 and cisco routers
Hi.I was wondering what the main difference Is between setting up a vpn with windows 7 or configuring It on cisco routers.
When you setup the vpn on windows 7 or xp do the client and server pc's take care of the encryption and decryption whereas configuring vpn on routers , the encryption and decryption Is done solely by the routers?
If I want to setup a connection where an IP In the same Internal lan Is assigned to the client pc I'm guessing I'd have to use a router configuration.
ThanksThank you for the response, lucky for me there was another option. Threatened to cancel with the ISP on the NAT side unless they assigned us a public static ip/gateway/subnet. They ended up doing that and the VPN connected as soon as the changes were made in the Linksys.
-
NAT overload is not working when i configure Double NAT for VPN
I have Cisco 2921 router with OS version 15.1(4)M1.
the router is configured for NAT overload and working fine, i have site to site VPN tunnel with peer with normal NAT translation. now we need to configure Double NAT on the VPN tunnel as we need to free the subnet on peer network. for double nat i use 3.2.21.x - 3.2.23.x / 24 network and apply following command
Double NAT translation
ip nat inside source static network 192.168.10.0 3.2.21.0 /24 no-alias
ip nat inside source static network 192.168.20.0 3.2.22.0/24 no-alias
ip nat inside source static network 192.168.30.0 3.2.23.0 /24 no-alias
Nonat
access-list 101 deny ip 3.2.21.0 0.0.0.255 3.2.1.0 0.0.0.255
access-list 101 deny ip 3.2.22.0 0.0.0.255 3.2.1.0 0.0.0.255
access-list 101 deny ip 3.2.23.0 0.0.0.255 3.2.1.0 0.0.0.255
VPN encrypted traffic over the tunnel
access-list 115 permit ip 3.2.21.0 0.0.0.255 3.2.1.0 0.0.0.255
access-list 115 permit ip 3.2.22.0 0.0.0.255 3.2.1.0 0.0.0.255
access-list 115 permit ip 3.2.23.0 0.0.0.255 3.2.1.0 0.0.0.255
Problem:
as soon as i apply Double NAT translation command the NAT overload stop working and client cannot reach to the internet
the router partial configuration is as below
REACH-R01(config)#do sh run
Building configuration...
Current configuration : 19233 bytes
! Last configuration change at 09:56:45 MST Tue Jan 29 2013 by admin
! NVRAM config last updated at 13:57:54 MST Wed Jan 30 2013
! NVRAM config last updated at 13:57:54 MST Wed Jan 30 2013
version 15.1
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
hostname REACH-R01
boot-start-marker
boot-end-marker
card type t1 0 0
logging buffered 51200 warnings
no aaa new-model
clock timezone MST -7 0
clock summer-time MST recurring
network-clock-participate wic 0
network-clock-select 1 T1 0/0/0
no ipv6 cef
ip source-route
ip cef
ip dhcp excluded-address 192.168.20.1 192.168.20.99
ip dhcp excluded-address 192.168.20.250 192.168.20.255
ip dhcp pool CISCO_PHONES
network 192.168.20.0 255.255.255.0
default-router 192.168.20.254
option 150 ip 192.168.20.254
no ip domain lookup
ip domain name reach.local
ip inspect name ethernetin ftp timeout 3600
ip inspect name ethernetin h323 timeout 3600
ip inspect name ethernetin http timeout 3600
ip inspect name ethernetin rcmd timeout 3600
ip inspect name ethernetin realaudio timeout 3600
ip inspect name ethernetin smtp timeout 3600
ip inspect name ethernetin sqlnet timeout 3600
ip inspect name ethernetin streamworks timeout 3600
ip inspect name ethernetin tcp timeout 3600
ip inspect name ethernetin tftp timeout 30
ip inspect name ethernetin udp timeout 15
ip inspect name ethernetin vdolive timeout 3600
multilink bundle-name authenticated
isdn switch-type primary-ni
trunk group PRI
crypto pki token default removal timeout 0
crypto pki trustpoint TP-self-signed-3180627716
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-3180627716
revocation-check none
rsakeypair TP-self-signed-3180627716
voice-card 0
dsp services dspfarm
voice service voip
allow-connections sip to sip
fax protocol t38 version 0 ls-redundancy 0 hs-redundancy 0 fallback none
sip
voice translation-rule 1
rule 5 /^7804981231/ /401/
voice translation-rule 2
rule 5 // /7804981231/
voice translation-profile DID_INBOUND
translate called 1
voice translation-profile DID_OUTBOUND
translate calling 2
license udi pid CISCO2911/K9 sn FGL1540114P
license accept end user agreement
license boot module c2900 technology-package securityk9
hw-module ism 0
hw-module pvdm 0/0
username test test
redundancy
controller T1 0/0/0
cablelength long 0db
pri-group timeslots 1-6,24
no ip ftp passive
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 2
crypto isakmp key P@ssw0rd address 33.33.33.33 no-xauth
crypto ipsec transform-set ESP-AES256-SHA esp-aes 256 esp-sha-hmac
crypto map VPN-TUNNEL 1 ipsec-isakmp
description COMPUGEN
set peer 33.33.33.33
set transform-set ESP-AES256-SHA
match address 115
interface Embedded-Service-Engine0/0
no ip address
shutdown
interface GigabitEthernet0/0
description Outside Interface To the Internet
ip address dhcp
ip access-group outside_access_in in
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
crypto map VPN-TUNNEL
interface ISM0/0
ip unnumbered GigabitEthernet0/1.20
service-module ip address 192.168.20.2 255.255.255.0
!Application: CUE Running on ISM
service-module ip default-gateway 192.168.20.254
interface GigabitEthernet0/1
no ip address
ip nat inside
ip virtual-reassembly in
duplex auto
speed auto
interface GigabitEthernet0/1.10
description VLAN 10 DATA VLAN
encapsulation dot1Q 10
ip address 192.168.10.254 255.255.255.0
ip nat inside
ip inspect ethernetin in
ip virtual-reassembly in
interface GigabitEthernet0/1.20
description VLAN 20 VOICE VLAN
encapsulation dot1Q 20
ip address 192.168.20.254 255.255.255.0
ip nat inside
ip virtual-reassembly in
interface GigabitEthernet0/1.30
description VLAN 30 WIRELESS VLAN
encapsulation dot1Q 30
ip address 192.168.30.254 255.255.255.0
ip nat inside
ip inspect ethernetin in
ip virtual-reassembly in
interface GigabitEthernet0/2
no ip address
shutdown
duplex auto
speed auto
interface ISM0/1
description Internal switch interface connected to Internal Service Module
no ip address
interface Serial0/0/0:23
no ip address
encapsulation hdlc
isdn switch-type primary-ni
isdn incoming-voice voice
trunk-group PRI
no cdp enable
interface Vlan1
no ip address
ip forward-protocol nd
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip http path flash:CME8.6/GUI
ip nat inside source static tcp 192.168.10.10 443 interface GigabitEthernet0/0 443
ip nat inside source static tcp 192.168.10.10 25 interface GigabitEthernet0/0 25
ip nat inside source static tcp 192.168.10.10 1723 interface GigabitEthernet0/0 1723
ip nat inside source static tcp 192.168.10.10 3389 interface GigabitEthernet0/0 3389
ip nat inside source static tcp 192.168.10.10 123 interface GigabitEthernet0/0 123
ip nat inside source static tcp 192.168.10.10 987 interface GigabitEthernet0/0 987
ip nat inside source list 101 interface GigabitEthernet0/0 overload
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0 75.152.248.1
ip route 0.0.0.0 0.0.0.0 75.152.248.1 254
ip route 0.0.0.0 0.0.0.0 205.206.0.1 254
ip route 192.168.20.2 255.255.255.255 ISM0/0
ip access-list extended outside_access_in
permit udp any any eq bootps
permit udp any any eq bootpc
permit tcp any host 22.22.22.22 eq 1723
permit tcp any host 22.22.22.22 eq 3389
permit tcp any host 22.22.22.22 eq smtp
permit tcp any host 22.22.22.22 eq 443
permit tcp any host 22.22.22.22 eq domain
permit udp any host 22.22.22.22 eq domain
permit tcp any host 22.22.22.22 eq 123
permit icmp any host 22.22.22.22 unreachable
permit icmp any host 22.22.22.22 echo-reply
permit icmp any host 22.22.22.22 packet-too-big
permit icmp any host 22.22.22.22 time-exceeded
permit icmp any host 22.22.22.22 traceroute
permit icmp any host 22.22.22.22 administratively-prohibited
permit icmp any host 22.22.22.22 echo
permit tcp any host 22.22.22.22 eq 987
permit tcp any host 22.22.22.22 eq 47
permit gre any host 22.22.22.22
permit udp any host 22.22.22.22 eq isakmp
permit esp any host 22.22.22.22
access-list 23 permit any
access-list 101 deny ip 192.168.20.0 0.0.0.255 3.2.1.0 0.0.0.255
access-list 101 deny ip 192.168.30.0 0.0.0.255 3.2.1.0 0.0.0.255
access-list 101 deny ip 192.168.10.0 0.0.0.255 3.2.1.0 0.0.0.255
access-list 101 deny ip 3.2.21.0 0.0.0.255 3.2.1.0 0.0.0.255
access-list 101 deny ip 3.2.22.0 0.0.0.255 3.2.1.0 0.0.0.255
access-list 101 deny ip 3.2.23.0 0.0.0.255 3.2.1.0 0.0.0.255
access-list 101 permit ip 192.168.10.0 0.0.0.255 any
access-list 101 permit ip 192.168.20.0 0.0.0.255 any
access-list 101 permit ip 192.168.30.0 0.0.0.255 any
access-list 110 permit ip 0.0.0.0 255.255.255.0 0.0.0.0 255.255.255.0
access-list 115 permit ip 3.2.21.0 0.0.0.255 3.2.1.0 0.0.0.255
access-list 115 permit ip 3.2.22.0 0.0.0.255 3.2.1.0 0.0.0.255
access-list 115 permit ip 3.2.23.0 0.0.0.255 3.2.1.0 0.0.0.255
Solution: Support forums teamI have the same problem also. Restarting isn't helping and the auto lock/unlock button is on. Plus a couple of time when I turn it on it is asking if I want to power off. That is when I push the button on the front to wake it up. Not the power button on top. I have an IPAd 2. Worked fine before the update.
-
With Ajay Kumar and Telmo Pereira
Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions about configuration and troubleshooting the Cisco Application Control Engine (ACE) load balancer with Cisco expert Ajay Kumar and Telmo Pereira. The Cisco ACE Application Control Engine Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers is a next-generation load-balancing and application-delivery solution. A member of the Cisco family of Data Center 3.0 solutions, the module: Helps ensure business continuity by increasing application availability Improves business productivity by accelerating application and server performance Reduces data center power, space, and cooling needs through a virtualized architecture Helps lower operational costs associated with application provisioning and scaling
Ajay Kumar is a customer support engineer in the Cisco Technical Assistance Center in Brussels, covering content delivery network technologies including Cisco Application Control Engine, Cisco Wide Area Application Services, Cisco Content Switching Module, Cisco Content Services Switches, and others. He has been with Cisco for more than four years, working with major customers to help resolve their issues related to content products. He holds DCASI and VCP certifications.
Telmo Pereira is a customer support engineer in the Cisco Technical Assistance Center in Brussels, where he covers all Cisco content delivery network technologies including Cisco Application Control Engine (ACE), Cisco Wide Area Application Services (WAAS), and Digital Media Suite. He has worked with multiple customers around the globe, helping them solve interesting and often highly complex issues. Pereira has worked in the networking field for more than 7 years. He holds a computer science degree as well as multiple certifications including CCNP, DCASI, DCUCI, and VCP
Remember to use the rating system to let Ajay know if you have received an adequate response.
Ajay and Telmo might not be able to answer each question due to the volume expected during this event. Remember that you can continue the conversation on the Data Center sub-community discussion forum Application Networking shortly after the event.
This event lasts through July 26, 2013. Visit this forum often to view responses to your questions and the questions of other community members.Hello Krzysztof,
Another set of good/interesting questions posted. Thanks!
I will try to clarify your doubts.
In the output below both resources (proxy-connections and ssl-connections rate) are configured with a min percentage of resources (column Min), while 'Max' is set to equal to the min.
ACE/Context# show resource usage
Allocation
Resource Current Peak Min Max Denied
-- outputs omitted for brevity --
proxy-connections 0 16358 16358 16358 17872
ssl-connections rate 0 626 626 626 23204
Most columns are self explanatory, 'Current' is current usage, 'Peak' is the maximum value reached, and the most important counter to monitor 'Denied' represents the amount of packets denied/dropped due to exceeding the configured limits.
On the resources themselves, Proxy-connections is simply the amount of proxied connections, in other words all connections handled at layer 7 (SSL connections are proxied, as are any connections with layer 7 load balance policies, or inspection).
So in this particular case for the proxy-connections we see that Peak is equal to the Max allocated, and as we have denies we can conclude that you have surpassed the limits for this resource. We see there were 17872 connections dropped due to that.
ssl-connections rate should be read in the same manner, however all values for this resource are in bytes/s, except for Denied counter, that is simply the amount of packets that were dropped due to exceeding this resource.
For your particular tests you have allocated a min percentage and set max equal to min, this way you make sure that this context will not use any other additional resources.
If you had set the max to unlimited during resource allocation, ACE would be allowed to use additional resources on top of those guaranteed, if those resources were available.
This might sound a great idea, but resource planning on ACE should be done carefully to avoid any sort of oversubscription, specially if you have business critical contexts.
We have a good reference for ACE resource planning that contains also description of all resources (this will help to understand the output better):
http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/v3.00_A2/configuration/virtualization/guide/config.html#wp1008224
1) When a resource is utilized to its maximum limit, the ACE denies additional requests made by any context for that resource. In other words, the action is to Drop. ACE should in theory silently drop (No RST is sent back to the client). So unless we changed something on the code, this is what you should see.
To give more context, seeing resets with SSL connections is not necessarily synonym of drops. As it is usual to see them during normal transactions.
For instance Microsoft servers are usually ungracefully terminating SSL connections with RESET. Also when there is renegotiation during an SSL transaction you may see RESETS, but this will pass unnoticed for end users.
2) ACE will simply drop/ignore new connections when we reach the maximum amount of proxied connections for that context. Exisiting connections will continue there.
As ACE doesn't respond back, client would simply retransmit, and if he is lucky maybe in the next attempt he will be able to establish the connection.
To overcome the denies, you will definitely have to increase the resource allocation. This of course, assuming you are not reaching any physical limit of the box.
As mentioned setting max as unlimited might work for you, assuming there are a lot of unused resources on the box.
3) If a new connection comes in with a sticky value, that matches the sticky entry of a real server, which is already in MAXCONNS state, then both the ACE module/appliance should reject the connection and that sticky entry would be removed.
The client would at that point reestablish a new connection and ACE would associate a new sticky entry with the flow for a new RSERVER after the loadbalancing decision.
I hope this makes things clearer! Uff...
Regards,
Telmo -
Securing Telnet access on Cisco routers (access class)
Dear All,
In all my network i have cisco catalyst switch and cisco routers deployed in my WAN. In cisco routers, it was activated an ACL to secure telnet access to WAN devices. only 3 hosts (remote) were autorized to access these devises. I need to modify this secuirty to have access from the LAN (locally).
The ACL was implmented in all routers, and activated using access class in.
in there any idea without changing more the configuration and only tell the router to apply this ACL for WAN and not access for the LAN ?
Thanks for your help,
Best regards,Hi,
here is the ip int brief.
thanks
CISCO1841#show ip int brief
Interface IP-Address OK? Method Status Protocol
FastEthernet0/0 192.168.1.1 YES NVRAM up up
FastEthernet0/1 192.168.2.1 YES NVRAM up up
ATM0/0/0 unassigned YES NVRAM up up
Dot11Radio0/1/0 unassigned YES NVRAM up up
Dot11Radio0/1/0.1 192.168.2.129 YES NVRAM up up
Dot11Radio0/1/0.2 192.168.3.1 YES NVRAM up up
NVI0 unassigned NO unset up up
Virtual-Access1 unassigned YES unset up up
Dialer1 151.16.203.203 YES IPCP up up -
Hi,
Can we make transcoding in cisco gateways like IAD, 2800, 2900 series routers independently from the CUCM or CMExpress? I mean there is an IP PBX and there is service provider. There is no cucm or cm express. Router is working like IP2IP gateway. If the calls are coming to the router G711 and pbx is accepting only G729 so is there a way to make transcoding and change the codec to G729 on the router?
Thanks.Unified Border Element Transcoding Configuration Example
http://www.cisco.com/en/US/partner/products/sw/voicesw/ps5640/products_configuration_example09186a008092d6b3.shtml
Above link is the way you would need to do this.
HTH
java
If this helps, please rate
www.cisco.com/go/pdihelpdesk -
Hi Dears.
I configurated site to site vpn on router. The peer want interesting traffic to our side user subnet must be 10.193.115.11 but our local subnet is
10.103.70.0/24. our local subnet is also access to internet.
local subnet: 10.10.3.70.0/24
peer local subnet: 10.193.128.11/23
i think that i must be do policy nat.
1. ip access-list extended vpn-traffic
permit ip 10.193.115.0 0.0.0.255 10.193.128.0 0.0.1.255
2. ip access-list extended nat-ipsec
permit ip 10.103.70.0 0.0.0.255 10.193.128.0 0.0.1.255
3.ip nat pool mswpool 10.193.115.1 10.193.115.14 netmask 255.255.255.240
ip nat inside source list nat-ipsec pool mswpool
And i have also PAT Nat for local user.
access-list 100 permit ip 10.103.70.0 0.0.0.255 any
ip nat inside source list 100 interface GigabitEthernet0/0 overload
is this configuration rigth?
please write your comment.
thanks.ok. thanks.
at last our configuration is that:
access-list 100 deny ip 10.103.70.0 0.0.0.255 10.193.128.0 0.0.1.255
access-list 100 permit ip 10.103.70.0 0.0.0.255 any
ip nat inside source list 100 interface GigabitEthernet0/0 overload
for vpn traffic:
ip nat pool mswpool 10.193.115.1 10.193.115.14 netmask 255.255.255.240
ip nat inside source list nat-ipsec pool mswpool
ip access-list extended vpn-traffic
permit ip 10.193.115.0 0.0.0.255 10.193.128.0 0.0.1.255
ip access-list extended nat-ipsec
permit ip 10.103.70.0 0.0.0.255 10.193.128.0 0.0.1.255
you said that this configuration is help me for my aim.
thanks again. -
Question about configuration of NAT on ASA
Hi all,
I have ASA config with DHCP and its providing IP to users.
ASA is connected to 3550 switch it has direct connection or say default static route
From 3550 switch connection goes to Router and it does the NAT and has connection to outside world.
My question is do i need to configure the NAT inside and global (outside ) on the ASA or not?
As per my understanding NAT is done by router which has connection to ISP.
Thanks
MaheshHi Jennifer,
Thanks for replied.
I tested like this config the NAT on ASA
then as per your reply run the command no nat-control as ASA ver is 8.4
But nat config is still there in ASA.
I did sh xlate it shows
ciscoasa# sh xlate
27 in use, 371 most used
PAT Global 192.168.11.2(33396) Local 192.168.1.5(57177)
PAT Global 192.168.11.2(61657) Local 192.168.1.5(57176)
PAT Global 192.168.11.2(52259) Local 192.168.1.5(57175)
PAT Global 192.168.11.2(30453) Local 192.168.1.5(57174)
I did clear xlate still there is output from the sh xlate
My question is how we test that ASA is nating or not ?
Which commands can tell us that ASA is doing NAT ?
Thanks
MAhesh -
Facing issue in using SNMPV3 on Cisco Routers
Hi,
Actually, i am trying to implement SNMPV3 on Cisco Routers & Switches to manage & monitor these devices in a more secure manner using NMS called Orion (NPM) Network Performance Monitor.
When i am going to add the node on Orion (NPM), it is showing me an error that the device does not support the interfaces MIB.
The Routers IOS Version and its feature set is as under:
Cisco 3800 & 2800 (IOS version 12.4(20)T2 Advance IP Services).
Configuration as under:
snmp-server DEPT_GRP V3 auth context DEPT_CTX read DEPT_VIEW
snmp-server view DEPT_VIEW iso included
snmp-server view DEPT_VIEW internet included
snmp-server view DEPT_VIEW interfaces included
snmp-server view DEPT_VIEW system included
snmp-server view DEPT_VIEW chassis included
snmp-server context DEPT_CTX
snmp-server user SNMPADMIN DEPT_GRP v3 auth sha cisco123 priv des cisco123
snmp-server host 213.42.48.158 version 3 auth SNMPADMIN
At Orion parameters are given as under:
username :- SNMPADMIN
SNMPV3 context :- DEPT_CTX
SNMPV3 Authentication :- SHA1
SNMPV3 Privacy/Encryption :- DES56
Password Key :- cisco123 (All the places)
Kindly help me out and advise me where i am going wrong. Kindly check the configuration above is anything missing in it regarding the SNMPV3 configuration.
Rgds,
Ayaz AliHi Joe,
Thanks for your response. As per your reply, i had removed the context and views which were configured earlier on the router and followed the same instructions as you mentioned in your reply, but i would like to tell you one thing about the configuration that i had done for snmp v3.
Your configuration is :-
snmp-server group DEPT_GRP v3 auth read v1default
snmp-server user SNMPADMIN DEPT_GRP v3 auth sha cisco123 priv des cisco123
My Configuration is :-
snmp-server group DEPT_GRP v3 priv read v1default
snmp-server user SNMPADMIN DEPT_GRP v3 auth sha cisco123 priv des cisco123
In your configuration, you are using Authentication (Auth) for the SNMP v3 group and if u select auth (Keyword) then you have to only provide authentication method (SHA,MD5) no privacy keys for encryption (DES,AES) in snmp user configuration, otherwise it will give you an error that credential not matched on the host when you try to poll the device.
In my configuration, I am using privacy (priv) for the SNMP v3 group, thats why i had given both authentication and encryption keys under SNMP user configuration.
In short, user settings are dependent on the group settings if you are using auth then it only support authentication but no privacy and if you are using priv then it allow both authentication and encryption (privacy).
Thanks for your support, it really helped me out in solving the issue. Now, i am able to poll my all routers using snmp v3.
Rgds,
Ayaz Ali -
The difference of the IEEE802.1x Auth between Cisco Routers and Catalyst switches
Hello
I am investigating the difference of the IEEE802.1x Auth between Routers and Switches.
Basically dot1x auth is availlable on Catalyst Switches. however if I want to check to
PortBased Multi-Auth , MAC address Auth and any certification Auth with this feature,
Is it possible to integrate into Cisco Router such as Cisco 891F ?
In my opinion Cisco891F is also available to use basic IEEE802.1x but if it compares with Catalyst switches such as Cat3560X
I think there might be any unsupported feature on Cisco 891F.
I appreciate any information. thank you very much in advance.
Best Regards,
Masanobu HiyoshiMany time in interviews asked comaprison between cisco routers and switches that i was answerless bcoz i dont have much knowledge about that.Can anyone provide me the compariosin sheet of the same.how are the cisco devices differ with each other how much Bandwidth each routres support and Etc...
Ummmm ... The most common question I get is "what is the difference between a router and a switch".
However, if you get a question like this, then my impression to this line of questioning are:
1. The candidate they are looking for has in-depth knowledge of routers and switches. And I mean IN-DEPTH!;
2. They are not looking for a candidate. They just want to stroke their ego. There is not alot of people who can give you the "names and numbers" of routers and switches at a snap of a finger. And if you do happen to know the answer, then and there, then expect a tougher follow-up question. -
Two Cisco Routers in one class-c network
Hello,
i have two cisco routers, which are connected to one switch. On this switch, there are several servers connected as well.
When i connected the second cisco router, i got messages on the first router, that there is an ip address conflict. After a few minutes it seems as if the vpn tunnel on the first router breaks down because of this conflict. I'm not sure about this, but when i disconnected the second router again, the vpn tunnel could be established again. The vpn tunnel goes to another router via WAN and ends in the local class-c network, where both routers are in.
Router1
LAN 192.168.105.254 (255.255.255.0)
WAN 212.xxx.xxx.xxx
||
||
Cisco Switch
||
||
Router2
LAN IP 192.168.105.253 (255.255.255.0)
WAN IP 217.xxx.xxx.xxx
Router1
int fa 0/1
ip address 192.168.105.254 255.255.255.0
Router2
int fa 0/1
ip address 192.168.105.253 255.255.255.0
Could the /24 mask on the interfaces cause the conflicts?
From the servers, none has the ip 192.168.105.253 or 192.168.105.254 and if i disconnect Router2, the IP 192.168.105.253 is not reachable from any system on the switch.
So how does this ip address conflict occur?hello,
can you check the router 1 log. with error message you should have a mac address
May 10 05:32:20.489: %IP-4-DUPADDR: Duplicate address 10.10.10.1 on GigabitEthernet0/1.1, sourced by 0003.oc12.a2c3
This should help you to identify host already with 192.168.105.253.
Before connecting Router 2, from Router 1 ping 192.168.105.253 and do a sh arp ?
HTH,
regards,
cisand -
Ask the Expert: Packet Capture Capabilities of Cisco Routers and Switches
With Rahul Rammanohar
Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions about packet capture capabilities of Cisco routers and switches.
In May 2013, we created a video that included packet capture capabilities across multiple Cisco routers and switches. For each product, we began with a discussion about the theory of the capabilities, followed by an explanation of the commands, and we concluded with a demo on real devices. In this Ask the Expert event, you’re encouraged to ask questions about the packet capture capabilities of these Cisco devices:
• 7600/6500: mini protocol analyzer (MPA), ELAM, and Netdr
• ASR9k: network processor capture
• 7200/ISRs: embedded packet capture
• Cisco Nexus 7K, 5K, and 3K: Ethanalyzer
• Cisco Nexus 7K: ELAM
• CRS: show captured packets
• ASR1K: embedded packet capture
More Information
Blog URL: Packet Capture Capabilities of Cisco Routers and Switches
Watch the Video: https://supportforums.cisco.com/videos/6226
Hitesh Kumar is a customer support engineer in the High-Touch Technical Services team at Cisco specializing in routing protocols. He has been supporting major service providers and enterprise customers in routing, Multiprotocol Label Switching (MPLS), multicast, and Layer 2 VPN (L2VPN) issues on routing platforms for more than three years. He has more than six years of experience in the IT industry and holds a CCIE certification (number 38757) in service.
Rahul Rammanohar is a technical leader with the High-Touch Technical Support Team in India. He handles escalations in the area of routing protocols and large-scale architectures for devices running Cisco IOS, IOS-XR, and IOS-XE Software. He has been supporting major service providers and large enterprise customers for routing, MPLS, multicast, and L2VPN issues on all routing platforms. He has more than 13 years of experience and holds a CCIE certification (number 13015) in routing/switching and service provider.
Remember to use the rating system to let Hitesh and Rahul know if you have received an adequate response.
Because of the volume expected during this event, Hitesh and Rahul might not be able to answer each question. Remember that you can continue the conversation in the Service Provider, sub-community forum shortly after the event. This event lasts through November 1, 2013. Visit this forum often to view responses to your questions and the questions of other Cisco Support Community members.Hello Erick
Thanks for the topology. The trigger will be different for labelled packet as you would need to mention the values of labels too in the trigger.
Below are two examples of one or two labels being used, it depends on where you are capturing the packet in mplsvpn scenario which will decide teh number of labels being imposed on the packet.
Trigger for one label. (if the router on which you are capturing the packet PHP is being performed)
VPN label - 5678
Source Address - 111.111.111.111
Destination Address - 123.123.123.123
show platform capture elam trigger dbus others if data = 0 0 0 0x88470162 0xE0000000 0 0 0x00006F6F 0x6F6F 7B7B 0x7B7B0000 [ 0 0 0 0xffffffff 0xf0000000 0 0 0x0000ffff 0xffffffff 0xffff0000 ]
Trigger for two labels. (for other core routers)
IGP label - 1234
VPN label - 5678
Source Address - 111.111.111.111
Destination Address - 123.123.123.123
show platform capture elam trigger dbus others if data = 0 0 0 0x8847004D 0x20000162 0xE0000000 0 0 0x00006F6F 0x6F6F7B7B 0x7B7B0000 [ 0 0 0 0xffffffff 0xf000ffff 0xf0000000 0 0 0x0000ffff 0xffffffff 0xffff0000 ]
You can check the labels being used (by using show ip cef <> details) and covert their values to hex and change the trigger accordingly.
I have changed the colors for better understanding. If you notice carefully in the trigger the values for ip address, labels have just been converted to their respective hex values which could be replaced.
Please let me know if this helps.
Thanks & Regards
Hitesh & Rahul -
Implementing WAAS using 3925 and 2911 Cisco routers
Dear all,
I am new to Cisco WAAS and therefore I would like to request some help regarding the following scenario:
I have a star network (1 hub and 5 spoke) topology where each satellite site is connected via a 2 MB (symmetric) to the Head-Quarters (Central node). In order to be able to concentrate all servers (services) at the head-quarters and improve the users experience in remote sites when accessing network services that are located at the head-quarters we want to implement Cisco WAAS instead of increasing the existing bandwidth.
At the head-quarters we are using a 3925 Cisco router and at the remote locations we are using 2911 Cisco routers. Last but not least there will be approximately 75 concurrent users from remote sites accessing resources at the head-quarters.
Currently I am planning to use the following:
·At the head-quarters I am planning to use a Cisco Wide Area Application Services (WAAS) Module: SM-SRE-900-K9 with an Enterprise license (for large deployment) in the Cisco router 3925
·At the remote sites I am planning to use a Cisco Wide Area Application Services (WAAS) Module: SM-SRE-700-K9 with an Enterprise license (for medium deployment) in the Cisco router 2911
Is there anything else that I am missing or need to take into consideration for deploying the WAAS.
Regards,
ScreechHi Screech,
Answers:
Is the dedicated WAE hw for central management purpose a required component?not required as WAEs can optimize even without Cntral managementbut you will not be able to collect statistics, reports and will have to manage WAEs from CLI. This a kind of highly recommended management piece you will need.
What is the difference between using a full blown WAE instead of a Sm SRE module: Using a fully blown WAE at DC is recommended as you are then avoiding couple of bottlenecks.
1. Bandwidth allcoation
2. SM / NM models have low capacity, disks where as fully blown models like 674s have 10k/15k SATA / SAS drives.
3. HW redundancy: you have backup PS / HD in dedicated WAEs in msot of the models.
4. HW dependency: Your SM moduels depened upon your router / switch. If for some reason, switch or router goes down, SM moule goes down at same time.
5. Additional NICs / HW availability.
There are various other reasons you might want to consider. You can ask your cisco sales engineer or one of the PDI help engineer on the forum can also punch in here.
but basicaly, I would go for fully blown WAE on DC side and central management piece as well.
Regards. -
Configuring IP SLA in cisco 3925 router.
HI Team.we need to configuring IP SLA in cisco 3925 router with c3900-universalk9-mz.SPA.151-4.M4.bin ios. For Monitoring purpose. Earlier we have used the rtr command for the same. Now we are going with new Cisco 3925 router. with the above mentioned IOS. Pls suggest whether we can configure the IP SLA in the router with Licence. Or We need to buy the licence for the ame.
Posted by WebUser Ramkumar Selvaraj from Cisco Support Community AppHi
I think the command has been updated - rather than 'rtr responder' it's now 'ip sla responder'.
I don't believe you need any particular feature set.
Also, this is a 'Contact Center' forum - you would get more responses in other places.
Regards
Aaron HarrisonPrincipal Engineer at Logicalis UK
Please rate helpful posts...
Maybe you are looking for
-
HT1349 can anyone help me find the itunes i downloaded on my netbook
Hi can anyone help me find my itunes download on my netbook. thanks
-
Abap function module for material standard price.
Dear Team, Can anyone tell me the abap function module for getting material standard price respective of date and material code as input. I have observe table MBEW, where we will get standard price of a material for last change date. Not getting any
-
How do you change the font size on a Mac mini so you can read stuff on a 55 inch tv
I have my Mac mini hooked up to my 55 inch vizio but when I'm sitting on my bed it's hard to read the tool bar in safari
-
Menu - Submenu - and Sub Sub Menu
on my site, for some reason, the "sub sub" menu buttons called "deal 2, and deal 3 to the right of the business cards button, only work (turning green for the rollover) when the "sub sub" menu buttons in the "business flyers" menu are not there. If I
-
Please HELP! Why won't Leopard install on my eMac?
When I put the Leopard DVD in my eMac it does not recognize it at all. I don't hear the drive running, and nothing pops up on the desktop. Altho it is an older machine, it meets all of the system requirements: 1GHz, 640MB, PowerPC G4, with plenty of