EIGRP (OTP)

Hi,
I am trying to do load sharing between tow link
first link connect through MPLS cloud 
the EIGRP OTP   working fine on it . 
second link connect through P2P 
also at P2P eigrp running 
in my routing table only show me one valid route 
is't possible to make load sharing thought 2 link 

Hi Ehsan,
With EIGRP, you can achieve load sharing if both paths to the same destination have the same best metric (equal-cast load balancing), or if the worse paths go through feasible successors and you configure the variance command (unequal-cost load balancing). In general, this is not trivial to achieve and may require a fair share of smart metric tweaking.
So the first thing to check is the output of the show ip eigrp topology table on the router with the two links (MPLS and P2P) and verify whether all destinations you want to load-balance for have at least one successor and one feasible successor identified. If yes then doing the load balancing is just a matter of activating the variance with a sensible value. If, however, the destinations only have a single successor and no feasible successor identified in the topology table then you will first need to start modifying metrics so that the neighbors first pass the feasibility condition and only then you can ask for load sharing.
I understand that this answer is just a very rough indication of where to focus your efforts, and is not a clean list of commands to apply to make the magic work. Tuning EIGRP metrics is not a routine task and it depends very strongly on your topology. What could perhaps help us suggest the more precise way of modifying your EIGRP metrics would be a listing of your show ip eigrp topology focusing on one particular network for which you'd like to achieve the load balancing. In that case please post the output of show ip eigrp topology X.X.X.X/M output so that we can see the component metrics in detail.
Best regards,
Peter

Similar Messages

  • Having an issue adding network to eigrp

    I'm doing a class project using a network simulator and am asked to: Design and implement an network for company RoutersCourseMatters.  The names of the department names at this company are Faculty, Staff, and Students.  For security reasons, each department must be isolated from each other's broadcast domain on the network.  The Faculty have 50 end devices that need to be connected to the network.  Staff has 26 end devices and the Students have 100 end devices.  The network spaced provided by the ISP is 192.168.0.0/24.  The dynamic protocol used for this network must be for Cisco-only equipment.  Test each department network with just one end device and ensure full connectivity across the entire network
    So we have our network topology setup for the class project(see picture attached). We are using one router for faculty+staff. Faculty has ip/mask of 192.168.0.1/26 and staff is: 192.168.0.65/27. we have a seperate router for students which the IP subnet for students is 192.168.0.150/25. The routers are directly connected and are using ips 192.168.0.98/29 & 192.168.0.100/29 so since the two routers are directly connected on the same subnet they have no issue pinging each other. The problem is pinging hosts from a subnet to hosts on a different subnet. When I try and add ANY 192.168.0.* subnet to eigrp it instead adds 192.168.16.* network. For instance on the faculty/student router if i do a 'router eigrp 1' command followed by 'network 192.168.0.0 0.0.0.63' it shows network 192.168.16.0 has been added to eigrp under show run. here is show run command:
    faculty/staff Con0 is now available
    Press RETURN to get started!
    faculty/staff>en
    faculty/staff#show run
    Building configuration...
    Current configuration : 874 bytes
    version 12.4
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname faculty/staff
    boot-start-marker
    boot-end-marker
    no aaa new-model
    ip cef
    ip subnet-zero
    interface FastEthernet0/0
      description blank
      ip address 192.168.0.65 255.255.255.224
      no ip directed-broadcast
    interface FastEthernet0/1
      description link to switch
      ip address 192.168.0.1 255.255.255.192
      no ip directed-broadcast
    interface Serial0/0/0
      ip address 192.168.20.2 255.255.255.0
      no ip directed-broadcast
      clockrate 2000000
    interface Serial0/0/1
      no ip address
      no ip directed-broadcast
      shutdown
      clockrate 2000000
    interface Serial0/1/0
      no ip address
      no ip directed-broadcast
      shutdown
      clockrate 2000000
    interface Serial0/1/1
      ip address 192.168.0.98 255.255.255.248
      no ip directed-broadcast
    router eigrp 1
     network 0.0.0.0
     network 192.168.1.1 0.0.0.0
     network 192.168.16.0
     network 192.168.20.0
     no auto-summary
    ip classless
    no ip http server
    no ip http secure-server
    control-plane
    line con 0
    line aux 0
    line vty 0 4
      login
    line vty 5 1180
      login
    scheduler allocate 20000 1000
    end
    faculty/staff#config t
    Enter configuration commands, one per line.  End with CNTL/Z
    faculty/staff(config)#router eigrp 1
    faculty/staff(config-router)#network 192.168.0.0 0.0.0.63
    faculty/staff(config-router)#exit
    faculty/staff(config)#exit
    faculty/staff#show run
    Building configuration...
    Current configuration : 874 bytes
    version 12.4
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname faculty/staff
    boot-start-marker
    boot-end-marker
    no aaa new-model
    ip cef
    ip subnet-zero
    interface FastEthernet0/0
      description blank
      ip address 192.168.0.65 255.255.255.224
      no ip directed-broadcast
    interface FastEthernet0/1
      description link to switch
      ip address 192.168.0.1 255.255.255.192
      no ip directed-broadcast
    interface Serial0/0/0
      ip address 192.168.20.2 255.255.255.0
      no ip directed-broadcast
      clockrate 2000000
    interface Serial0/0/1
      no ip address
      no ip directed-broadcast
      shutdown
      clockrate 2000000
    interface Serial0/1/0
      no ip address
      no ip directed-broadcast
      shutdown
      clockrate 2000000
    interface Serial0/1/1
      ip address 192.168.0.98 255.255.255.248
      no ip directed-broadcast
    router eigrp 1
     network 0.0.0.0
     network 192.168.1.1 0.0.0.0
     network 192.168.16.0
     network 192.168.20.0
     no auto-summary
    ip classless
    no ip http server
    no ip http secure-server
    --More--
    project.jpg
    Reply Reply to Main Discussion
        Cody Robinson
        Cody Robinson
        2:36pm
    Here is 'show ip eigrp topology' on staff/faculty router:
    faculty/staff Con0 is now available
    Press RETURN to get started!
    faculty/staff>en
    faculty/staff#show ip interface
    FastEthernet0/0 is up, line protocol is up
      Internet address is 192.168.0.65/27
      Broadcast address is 255.255.255.255
      Address determined by setup command
      MTU is 1514 bytes
      Helper address is not set
      Directed broadcast forwarding is disabled
      Outgoing access list is not set
      Inbound access list is not set
      Proxy ARP is enabled
      Local Proxy ARP is disabled
      Security level is default
      Split horizon is disabled
      ICMP redirects are always sent
      ICMP unreachables are always sent
      ICMP mask replies are never sent
      IP fast switching is enabled
      IP fast switching on the same interface is enabled
      IP Flow switching is disabled
      IP CEF switching is enabled
      IP CEF Fast switching turbo vector
      IP multicast fast switching is enabled
      IP multicast distributed fast switching is disabled
      IP route-cache flags are Fast, CEF
      Router Discovery is disabled
      IP output packet accounting is disabled
      IP access violation accounting is disabled
      TCP/IP header compression is disabled
      RTP/IP header compression is disabled
      Policy routing is disabled
      Network address translation is disabled
      BGP Policy Mapping is disabled
      WCCP Redirect outbound is disabled
      WCCP Redirect inbound is disabled
      WCCP Redirect exclude is disabled
    FastEthernet0/1 is up, line protocol is up
      Internet address is 192.168.0.1/26
      Broadcast address is 255.255.255.255
      Address determined by setup command
      MTU is 1514 bytes
      Helper address is not set
      Directed broadcast forwarding is disabled
      Outgoing access list is not set
      Inbound access list is not set
      Proxy ARP is enabled
      Local Proxy ARP is disabled
      Security level is default
      Split horizon is disabled
      ICMP redirects are always sent
      ICMP unreachables are always sent
      ICMP mask replies are never sent
      IP fast switching is enabled
      IP fast switching on the same interface is enabled
      IP Flow switching is disabled
      IP CEF switching is enabled
      IP CEF Fast switching turbo vector
      IP multicast fast switching is enabled
      IP multicast distributed fast switching is disabled
      IP route-cache flags are Fast, CEF
      Router Discovery is disabled
      IP output packet accounting is disabled
      IP access violation accounting is disabled
      TCP/IP header compression is disabled
      RTP/IP header compression is disabled
      Policy routing is disabled
      Network address translation is disabled
      BGP Policy Mapping is disabled
      WCCP Redirect outbound is disabled
      WCCP Redirect inbound is disabled
      WCCP Redirect exclude is disabled
    Serial0/0/0 is down, line protocol is down
      Internet address is 192.168.20.2/24
      Broadcast address is 255.255.255.255
      Address determined by setup command
      MTU is 1514 bytes
      Helper address is not set
      Directed broadcast forwarding is disabled
      Outgoing access list is not set
      Inbound access list is not set
      Proxy ARP is enabled
      Local Proxy ARP is disabled
      Security level is default
      Split horizon is disabled
      ICMP redirects are always sent
      ICMP unreachables are always sent
      ICMP mask replies are never sent
      IP fast switching is enabled
      IP fast switching on the same interface is enabled
      IP Flow switching is disabled
      IP CEF switching is enabled
      IP CEF Fast switching turbo vector
      IP multicast fast switching is enabled
      IP multicast distributed fast switching is disabled
      IP route-cache flags are Fast, CEF
      Router Discovery is disabled
      IP output packet accounting is disabled
      IP access violation accounting is disabled
      TCP/IP header compression is disabled
      RTP/IP header compression is disabled
      Policy routing is disabled
      Network address translation is disabled
      BGP Policy Mapping is disabled
      WCCP Redirect outbound is disabled
      WCCP Redirect inbound is disabled
      WCCP Redirect exclude is disabled
    Serial0/0/1 is administratively down, line protocol is down
      Internet protocol processing disabled
    Serial0/1/0 is administratively down, line protocol is down
      Internet protocol processing disabled
    Serial0/1/1 is up, line protocol is up
      Internet address is 192.168.0.98/29
      Broadcast address is 255.255.255.255
      Address determined by setup command
      MTU is 1514 bytes
      Helper address is not set
      Directed broadcast forwarding is disabled
      Outgoing access list is not set
      Inbound access list is not set
      Proxy ARP is enabled
      Local Proxy ARP is disabled
      Security level is default
      Split horizon is disabled
      ICMP redirects are always sent
      ICMP unreachables are always sent
      ICMP mask replies are never sent
      IP fast switching is enabled
      IP fast switching on the same interface is enabled
      IP Flow switching is disabled
      IP CEF switching is enabled
      IP CEF Fast switching turbo vector
      IP multicast fast switching is enabled
      IP multicast distributed fast switching is disabled
      IP route-cache flags are Fast, CEF
      Router Discovery is disabled
      IP output packet accounting is disabled
      IP access violation accounting is disabled
      TCP/IP header compression is disabled
      RTP/IP header compression is disabled
      Policy routing is disabled
      Network address translation is disabled
      BGP Policy Mapping is disabled
      WCCP Redirect outbound is disabled
      WCCP Redirect inbound is disabled
      WCCP Redirect exclude is disabled
    faculty/staff#show ip eigrp ?
      <1-65535>   Autonomous System
      accounting  IP-EIGRP Accounting
      interfaces  IP-EIGRP interfaces
      neighbors   IP-EIGRP neighbors
      topology    IP-EIGRP Topology Table
      traffic     IP-EIGRP Traffic Statistics
      vrf         Select a VPN Routing/Forwarding instance
    faculty/staff#show ip eigrp topology
    IP-EIGRP Topology Table for AS(1)/ID(192.168.20.2)
    Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,
           r - reply Status, s - sia Status
    P 192.168.0.0/26, 1 successors, FD is 2172416
             via Connected, FastEthernet0/1
    P 192.168.0.64/27, 1 successors, FD is 2172416
             via Connected, FastEthernet0/0
    P 192.168.0.96/29, 1 successors, FD is 2172416
             via Connected, Serial0/1/1
    faculty/staff#
        Cody Robinson
        Cody Robinson
        2:37pm
    Here is show run on students router:
    Students Con0 is now available
    Press RETURN to get started!
    Students>sh run
                ^
    % Invalid input detected at '^' marker.
    Students>en
    Students#sh run
    Building configuration...
    Current configuration : 874 bytes
    version 12.4
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname Students
    boot-start-marker
    boot-end-marker
    no aaa new-model
    ip cef
    ip subnet-zero
    interface FastEthernet0/0
      no ip address
      no ip directed-broadcast
      shutdown
    interface FastEthernet0/1
      description link to switch
      ip address 192.168.0.150 255.255.255.128
      no ip directed-broadcast
    interface Serial0/0/0
      ip address 192.168.10.1 255.255.255.0
      no ip directed-broadcast
      clockrate 2000000
    interface Serial0/0/1
      no ip address
      no ip directed-broadcast
      shutdown
      clockrate 2000000
    interface Serial0/1/0
      no ip address
      no ip directed-broadcast
      shutdown
      clockrate 2000000
    interface Serial0/1/1
      ip address 192.168.0.100 255.255.255.248
      no ip directed-broadcast
      clockrate 2000000
    router eigrp 1
     network 0.0.0.0
     network 192.168.1.1 0.0.0.0
     network 192.168.10.0
    ip classless
    no ip http server
    no ip http secure-server
    control-plane
    line con 0
    line aux 0
    line vty 0 4
      login
    line vty 5 1180
      login
    scheduler allocate 20000 1000
    end
    Students#

    Hello lolwar,
    From your setup and description you provided I see some mismatch in IP subneting you calculated.
    For instance in your diagram you have networks 192.168.0.0/26 (FACULTY), 192.168.0.64/27 (STAFF), 192.168.0.96/29 (point-to-point link between routers) and 192.168.0.128/25 (STUDENTS).
    First, you're wasting IP addresses, because you have unused space between point-to-point link and STUDENTS subnet. It's a good practice, when calculating subnets first calculate the biggest, subnet, then smaller one until the smallest one (usually some point-to-point cross-connects). For more about this see this guide.
    Now, the issue I see as the most important is, that you have in your diagram networks as I mentioned above, but into your EIGRP process you're adding completely different subnets (192.168.16.x, 192.168.20.x,...).
    I entered following:
    STUDENT ROUTER =------------>
    router eigrp 1
    network 192.168.0.96 0.0.0.7
    network 192.168.0.128 0.0.0.127
    FACULTY/STAFF ROUTER =------------->
    router eigrp 1
    network 192.168.0.0 0.0.0.63
    network 192.168.0.64 0.0.0.31
    network 192.168.0.96 0.0.0.7
    And all works just fine, computer's are able to ping each other. Also although it's not necessary, it's good to includes network wildcard mask into the "network" command under EIGRP (or OSPF) configuration.
    I hope this will help you (please rate if this is the case. Thanks.)

  • SSPR with OTP Email is not working

    Hi Everyone,
    I am facing issue with FIM SSPR OTP Email based with one of My FIM Deployments. First of All I explain environment:
    We have two different type of Users: For One Type of users We need QA Gate based Password Reset and For Other set of Users We need OTP email based Password Reset.
    NOTE: FIM Portal, Service & SSPR are in HA.
    What Approach I have followed:
    1) For QA Type User, I kept one Default "Anonymous User Can reset their Password" and in target resources selected "Specific Set for those Users" and In requester I kept "Anonymous User".
    2) For OTP Mail Type Users, I created a new MPR and Password Auth Workflow(Read Only OTP Activity) and Action workflow (Active Directory Password Reset Activity). And In MPR, in target resources selected "Set for this Type Of Users". and In requester
    I kept "Anonymous User".
    This approach was working in My personal Test lab which was not in HA. But now In HA, QA Based Password Reset is working fine and OTP based Password reset is throwing error. I am getting OTP mail but after entering reset Password, My process is unable to
    process successfully. On FIM Portal, in search request: This requeste is getting PostProcessingError. And Request is stating that "The Workflow instance ****** encountered an internal error during processing" and In applied policies it is showing
    MPR which I created.
    Please help. 
    If My Answer helps you do not forget to check helpful post and If answers your question do not forget to "Mark it as an Answer" Thanks~ Giriraj Singh Bhamu

    Hi,
    Thanks for your reply. I was successfully able to resolve the issue. It was related to .Net framework version used into Reset Action Workflow XOML. I just opened Workflow definition in Advance view and replaced version 4.0.0.0 with 3.5.0.0. 
    It worked magically. Thanks to the Post by : Predica.
    Link is : Click Here
    If My Answer helps you do not forget to check helpful post and If answers your question do not forget to "Mark it as an Answer" Thanks~ Giriraj Singh Bhamu

  • Error while trying to configure DirectAccess with OTP

    hi you all
    I have a working environment of DirectAccess 2012 R2 for Win8.1 clients (One DA Server)
    I have both Vasco and Azure MFA for OTP authentication and I wanted to add any of them to my DA topology
    I installed a new dedicated Enterprise-CA and added the OTP templates , added a new DAProbe user to my radius server and followed the rest of the documentation as described on TechNet.
    I know there's a bug in the DA UI wizard for OTP so I just enabled Two-Factor authentication and then from PowerShell I ran the command
    Enable-DAOtpAuthentication -CertificateTemplateName 'DirectAccessOTPLogon' -SigningCertificateTemplateName 'DirectAccessOTPRegistrationAuthority' -CAServer 'testdomain.com\CA' -RadiusServer MFA.testdomain.com -SharedSecret Aa123456
    and I get the following error:
    Enable-DAOtpAuthentication : The specified CA servers are either not valid enterprise CAs or specified incorrectly.
    Rerun the cmdlet with a valid CAServer parameter in the correct format (FQDN\CAServerName).
    At line:1 char:1
    + Enable-DAOtpAuthentication -CertificateTemplateName 'DirectAccessOTPLogon' -Sign ...
    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        + CategoryInfo          : NotSpecified: (CAServer:root/Microsoft/...pAuthentication) [Enable-DAOtpAuthentication],
        CimException
        + FullyQualifiedErrorId : HRESULT 80092004,Enable-DAOtpAuthentication
    My radius server is domain joined
    the PowerShell runs as Administrator
    firewalls are disabled on my DC, CA and my radius server and I can ping the CA without any issues
    The CA is Enterprise CA for sure and not Standalone
    I can issue certificates from the CA without any issues
    I tried to input the CA Server like this @{'domain.fqdn'}, 'domain.fqdn', domain.fqdn - all result the same
    I even tried to create another CA from scratch just to be sure the problem is not on my server...
    in anyway, I'm stuck. seems like no one else on the web ran into this error...
    I'd love to get some help on ways to troubleshoot the problem
    thanks
    Tamir Levy

    Hi,
    Microsoft recently published a fix for OTP activation problem with Windows Server 2012 R2 Remote Access Management Console :
    https://support.microsoft.com/en-us/kb/3047733/. Your error code remind me a Windows Server 2012 problem. Is subject name encoded in your IPHTTPS certificate is encoded in
    UTF-8 Format (https://support.microsoft.com/en-us/kb/2796394/)?
    BenoitS - Simple by Design http://danstoncloud.com/blogs/simplebydesign/default.aspx

  • OTP 2FA Problems with DA 2012 R2 and Windows 8.1 Client - Not prompting or OTP Code

    Hi 
    Just seeing if anyone has come across the same issue with their WIn 8.1 clients not prompting for 2FA once configured with DirectAccess 2012 R2?
    I have created the 2x OTP certificates, enabled OTP via PowerShell and set up the RADIUS server but whatever happens the Win 8.1 client does not get prompted for 2FA - They connect seamlessly?
    I have also configured the DAProbeUser on the RADIUS server
    Any help appreciated
    Thanks

    I was afraid that you'll said that
    I hate to be the annoying guy but take a look at this KB article:
    http://support.microsoft.com/kb/2787534
    Applied to: Windows 8\2012,
    Doesn't Apply to: Windows 8.1\2012 R2
    and - for a fact, doesn't include in Windows 8.1\2012 R2 as this bug still exists in those operating systems.
    another annoying fact - No other update was released for these version yet.
    this example approves that not every hotfix \ updates that was released for 8\2012 before 8.1\2012 R2, is already included in 8.1\2012 R2
    and allow me to add another fact.
    when you configure DirectAccess via the remote access wizard it creates a WMI query called
    DirectAccess - Laptop Only WMI Filter.
    after you create it in Windows Server 2012 R2 - look at the WMI Query and you'll see that by default it doesn't apply to version 6.3! the version for Windows 8.1.
    if you want to add the support for Windows 8.1 you have to modify manually the query which is of course, not supported by Microsoft.
    That is just another symptom that makes me wonder if Microsoft did ANY change or update to DirectAccess 2012 R2
    Tamir Levy

  • VPN Access to an IP that can be accessed via EIGRP

    I have a question. I have a VPN that sits on the external interface using the IP of 10.5.79.X/20. I have a production network connected to a corporate network using MPLS and EIGRP to share the routes. The production network can access the corporate network, but the the VPN users can't. I need to be able to access anything on that network which is mainly a 172.18.0.0 summarized by EIGRP network. I had this working before, but can't get it working again about my Firewall dumped on me.
    ASA Version 8.4(2)
    hostname hp-asa-5510-DR
    enable password 1qF1n5PuI7A.2DV. encrypted
    passwd 1qF1n5PuI7A.2DV. encrypted
    names
    dns-guard
    interface Ethernet0/0
    speed 100
    duplex full
    nameif external
    security-level 0
    ip address *142.189.26 255.255.255.252
    interface Ethernet0/1
    nameif internal
    security-level 100
    ip address 10.5.64.6 255.255.240.0
    interface Ethernet0/1.1
    vlan 2
    nameif Guest
    security-level 90
    ip address 192.168.3.1 255.255.255.0
    interface Ethernet0/2
    shutdown
    no nameif
    no security-level
    no ip address
    interface Ethernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    nameif management
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    management-only
    boot system disk0:/asa842-k8.bin
    boot system disk0:/asa821-k8.bin
    ftp mode passive
    clock timezone CST -6
    clock summer-time CDT recurring
    dns domain-lookup external
    dns domain-lookup internal
    dns server-group DefaultDNS
    name-server 208.67.222.222
    dns server-group Guest
    name-server 10.5.64.197
    name-server 8.8.8.8
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object network obj-10.5.65.239
    host 10.5.65.239
    object network obj-10.5.65.253
    host 10.5.65.253
    object network obj-10.5.65.42
    host 10.5.65.42
    object network obj-10.5.65.219
    host 10.5.65.219
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network Cegedim
    subnet 10.5.250.0 255.255.255.248
    description dendrite site to site VPN
    object network dfb
    subnet 10.5.0.0 255.255.0.0
    object network lausanne
    subnet 192.168.250.0 255.255.255.0
    description Lausanne
    object network dfbgroup
    subnet 10.5.0.0 255.255.0.0
    object network DPT
    subnet 10.5.16.0 255.255.240.0
    object network hpbexch
    host 10.5.64.198
    object network hpbmsvpn
    host 10.5.64.196
    object network kacehost
    host 10.5.65.189
    object network hpbsentry
    host 10.5.64.194
    object network hpbMDM
    host 10.5.64.195
    object network hperoom
    host 10.5.65.211
    description healthpoint eroom server
    object network spintranet
    host 10.5.65.185
    description sharepoint intranet
    object network spsales
    host 10.5.65.194
    description sharepoint sales
    object network spteams
    host 10.5.65.183
    description sharepoint teams
    object network Guest
    subnet 192.168.3.0 255.255.255.0
    object network Crystal
    host 10.5.65.203
    object network ERPLN
    host 10.5.65.234
    object network ERPLNDB
    host 10.5.65.237
    object service dpt
    service tcp source range 1 65000 destination range 1 65000
    description dpt ports
    object network Documentum
    host 10.5.17.216
    object network DPTDocumentum
    host 10.5.17.216
    description Documentum
    object network EzDocs
    host 10.5.17.235
    description EzDocs
    object network Aerosol
    subnet 10.5.32.0 255.255.240.0
    object network Brooks
    subnet 10.5.128.0 255.255.240.0
    object network DPTScience
    subnet 10.5.48.0 255.255.240.0
    object network LakeWood
    subnet 10.5.80.0 255.255.240.0
    object network Plant
    subnet 10.5.0.0 255.255.240.0
    object network warehouse
    subnet 10.5.240.0 255.255.240.0
    object network NotesApps
    host 10.5.65.235
    object network DPTNotes
    host 10.5.17.246
    object network DNSServer
    host 10.5.64.197
    object network GuestNetwork
    subnet 192.168.3.0 255.255.255.0
    object network KACE
    host 10.5.65.189
    object network mdm2
    host 10.5.64.195
    object network guesterooms
    host 10.5.65.211
    object network DNSServer2
    host 10.5.64.199
    object network asa_LAN
    host 10.5.64.6
    object network guestspsales
    host 10.5.65.194
    object network JohnsonControlServer
    host 10.5.65.33
    description JC Server
    object network guestexchange
    host 10.5.64.198
    description Guest Exchange
    object network guestmobile2
    host 10.5.64.194
    object network DPTDocB
    host 10.5.17.215
    object-group service EDI tcp
    port-object eq 50080
    port-object eq 6080
    port-object eq www
    object-group service Exchange tcp
    port-object eq 587
    port-object eq www
    port-object eq https
    port-object eq smtp
    object-group service Lotus-Sametime tcp
    port-object eq 1503
    port-object eq 1516
    port-object eq 1533
    port-object eq 8081
    port-object range 8082 8084
    port-object range 9092 9094
    port-object eq www
    port-object eq https
    port-object eq lotusnotes
    port-object eq rtsp
    object-group protocol TCPUDP
    protocol-object udp
    protocol-object tcp
    object-group service VPN-MS tcp-udp
    port-object eq 1701
    port-object eq 1723
    port-object eq 4500
    port-object eq 500
    object-group network Verizon-Servers
    network-object 216.82.240.0 255.255.240.0
    network-object 85.158.136.0 255.255.248.0
    network-object 193.109.254.0 255.255.254.0
    network-object 194.106.220.0 255.255.254.0
    network-object 195.245.230.0 255.255.254.0
    network-object 62.231.131.0 255.255.255.0
    network-object 64.124.170.128 255.255.255.240
    network-object 212.125.74.44 255.255.255.255
    network-object 195.216.16.211 255.255.255.255
    object-group network FDA_SecureEmail
    network-object host 150.148.2.65
    network-object host 150.148.2.66
    object-group network Web-Server-Stuff
    network-object host 204.71.89.34
    network-object host 204.71.89.35
    network-object host 204.71.89.33
    network-object host 66.240.207.149
    network-object host 68.168.88.169
    network-object host 50.112.164.102
    object-group service DFB-eRoom tcp
    port-object eq www
    port-object eq https
    object-group network EDI-Customers
    network-object host 129.33.204.13
    network-object host 143.112.144.25
    network-object host 160.109.101.195
    network-object host 198.89.160.113
    network-object host 199.230.128.125
    network-object host 199.230.128.85
    network-object host 205.233.244.208
    network-object host 198.89.170.134
    network-object host 198.89.170.135
    network-object host 199.230.128.54
    object-group service MDM tcp
    description MobileIron ports
    port-object eq 9997
    port-object eq 9998
    port-object eq https
    object-group network OpenDNS
    description OpenDNS Servers
    network-object host 208.67.220.220
    network-object host 208.67.222.222
    network-object host 8.8.8.8
    network-object host 68.113.206.10
    object-group network healthpoint
    network-object 10.5.64.0 255.255.240.0
    object-group network vpnpool
    network-object 10.5.79.0 255.255.255.0
    object-group network dfb_group
    network-object object dfbgroup
    object-group network lausanne_group
    network-object 192.168.250.0 255.255.255.0
    object-group network DPTNetwork
    network-object object DPT
    network-object object Aerosol
    network-object object Brooks
    network-object object LakeWood
    network-object object Plant
    object-group network DM_INLINE_NETWORK_1
    network-object object Cegedim
    network-object object lausanne
    group-object DPTNetwork
    network-object object DPTNotes
    object-group service DFB-Allow tcp
    port-object eq 1025
    port-object eq 1119
    port-object eq 1120
    port-object range 1222 1225
    port-object eq 1433
    port-object eq 1503
    port-object eq 1516
    port-object eq 1533
    port-object range 16384 16403
    port-object eq 1755
    port-object eq 1919
    port-object eq 1935
    port-object range 2195 2196
    port-object eq 3050
    port-object eq 3080
    port-object eq 3101
    port-object eq 3244
    port-object eq 3264
    port-object eq 3306
    port-object eq 3389
    port-object eq 3724
    port-object eq 4000
    port-object eq 402
    port-object range 4080 4081
    port-object eq 4085
    port-object eq 50080
    port-object eq 5085
    port-object range 5220 5223
    port-object eq 5297
    port-object eq 5298
    port-object eq 5353
    port-object eq 5550
    port-object eq 5678
    port-object eq 58570
    port-object eq 5900
    port-object eq 6080
    port-object eq 6112
    port-object eq 6114
    port-object eq 6900
    port-object eq 7800
    port-object eq 8010
    port-object eq 8080
    port-object eq 8084
    port-object eq 81
    port-object eq 9081
    port-object eq 9090
    port-object eq 9997
    port-object eq aol
    port-object eq citrix-ica
    port-object eq echo
    port-object eq ftp
    port-object eq ftp-data
    port-object eq www
    port-object eq https
    port-object eq lotusnotes
    port-object eq rtsp
    port-object eq sip
    port-object eq sqlnet
    port-object eq ssh
    port-object eq 442
    object-group network webservers
    network-object host 204.71.89.34
    network-object host 204.71.89.35
    object-group network DM_INLINE_NETWORK_2
    network-object object KACE
    network-object object guesterooms
    network-object object guestspsales
    network-object object JohnsonControlServer
    network-object object mdm2
    object-group network DM_INLINE_NETWORK_3
    network-object host 10.5.65.230
    network-object host 10.5.65.232
    network-object object hpbexch
    object-group service DM_INLINE_TCP_1 tcp
    port-object eq www
    port-object eq https
    object-group service kace tcp
    port-object eq 52230
    port-object eq www
    port-object eq https
    port-object eq 445
    port-object eq netbios-ssn
    object-group service DM_INLINE_TCP_0 tcp
    port-object eq www
    port-object eq https
    object-group service DM_INLINE_SERVICE_1
    service-object ip
    service-object tcp destination eq www
    service-object tcp destination eq https
    object-group service DM_INLINE_TCP_2 tcp
    port-object eq www
    port-object eq https
    object-group network VLAN_Switches
    network-object host 192.168.10.10
    network-object host 192.168.10.11
    network-object host 192.168.10.12
    network-object host 192.168.10.13
    network-object host 192.168.10.14
    network-object host 192.168.10.15
    network-object host 192.168.10.16
    network-object host 192.168.10.17
    network-object host 192.168.10.1
    object-group network Crystal_ERP
    description Crystal Enterprise and Infor LN
    network-object object Crystal
    network-object object ERPLN
    network-object object ERPLNDB
    network-object object NotesApps
    object-group service DM_INLINE_SERVICE_2
    service-object ip
    service-object tcp destination eq www
    service-object tcp destination eq https
    object-group network GuestDNS
    description DNS Servers for Guest
    network-object object DNSServer
    network-object object DNSServer2
    object-group service DM_INLINE_TCP_3 tcp
    port-object eq 3389
    port-object eq 3390
    object-group network DM_INLINE_NETWORK_4
    group-object healthpoint
    group-object vpnpool
    access-list external_access_out extended permit object-group DM_INLINE_SERVICE_1 192.168.3.0 255.255.255.0 any
    access-list external_access_out remark Production ACL
    access-list external_access_out extended permit tcp any any object-group DFB-Allow
    access-list external_access_out extended permit icmp any any
    access-list external_access_out extended permit tcp any object-group Web-Server-Stuff
    access-list external_access_out remark Site to Site connections
    access-list external_access_out extended permit ip any object-group DM_INLINE_NETWORK_1
    access-list external_access_out extended permit udp any object-group OpenDNS eq domain
    access-list external_access_out extended permit ip object-group DM_INLINE_NETWORK_3 any
    access-list split standard permit 10.5.64.0 255.255.240.0
    access-list split standard permit 10.5.250.0 255.255.255.248
    access-list split standard permit 10.5.128.0 255.255.240.0
    access-list split standard permit 10.5.144.0 255.255.240.0
    access-list split standard permit 10.5.16.0 255.255.240.0
    access-list split standard permit 10.5.32.0 255.255.240.0
    access-list split standard permit 10.5.96.0 255.255.240.0
    access-list split standard permit 10.5.80.0 255.255.240.0
    access-list split standard permit 10.5.48.0 255.255.240.0
    access-list split standard permit 10.5.0.0 255.255.240.0
    access-list split remark lausanne
    access-list split standard permit 192.168.250.0 255.255.255.0
    access-list split standard permit 172.18.0.0 255.255.0.0
    access-list split remark HP
    access-list external_access_in extended permit object-group DM_INLINE_SERVICE_2 any 192.168.3.0 255.255.255.0
    access-list external_access_in remark Sharepoint
    access-list external_access_in extended permit tcp any object spsales object-group DM_INLINE_TCP_2
    access-list external_access_in remark Sharepoint
    access-list external_access_in extended permit tcp any object spteams object-group DM_INLINE_TCP_1
    access-list external_access_in remark Sharepoint
    access-list external_access_in extended permit tcp any object spintranet object-group DM_INLINE_TCP_0
    access-list external_access_in remark healthpoint erooms
    access-list external_access_in extended permit tcp any object hperoom object-group DFB-eRoom
    access-list external_access_in remark MDM2 VSP
    access-list external_access_in extended permit tcp any object hpbMDM object-group MDM
    access-list external_access_in remark New Sentry
    access-list external_access_in extended permit tcp any object hpbsentry eq https
    access-list external_access_in remark kace mgmt appliacne
    access-list external_access_in extended permit tcp any object kacehost object-group kace
    access-list external_access_in remark authentication server
    access-list external_access_in extended permit object-group TCPUDP any object hpbmsvpn object-group VPN-MS
    access-list external_access_in extended permit gre any object hpbmsvpn
    access-list external_access_in remark HPB.NET new forest Exchange
    access-list external_access_in extended permit tcp any object hpbexch object-group Exchange
    access-list external_access_in remark EDI Inbound
    access-list external_access_in extended permit tcp any host 10.5.65.42 object-group EDI
    access-list AnyConnect_Client_Local_Print extended deny ip any any
    access-list AnyConnect_Client_Local_Print extended permit tcp any any eq lpd
    access-list AnyConnect_Client_Local_Print remark IPP: Internet Printing Protocol
    access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 631
    access-list AnyConnect_Client_Local_Print remark Windows' printing port
    access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 9100
    access-list AnyConnect_Client_Local_Print remark mDNS: multicast DNS protocol
    access-list AnyConnect_Client_Local_Print extended permit udp any host 224.0.0.251 eq 5353
    access-list AnyConnect_Client_Local_Print remark LLMNR: Link Local Multicast Name Resolution protocol
    access-list AnyConnect_Client_Local_Print extended permit udp any host 224.0.0.252 eq 5355
    access-list AnyConnect_Client_Local_Print remark TCP/NetBIOS protocol
    access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 137
    access-list AnyConnect_Client_Local_Print extended permit udp any any eq netbios-ns
    access-list external_cryptomap extended permit ip object-group healthpoint object Cegedim
    access-list external_cryptomap_1 extended permit ip object-group dfb_group object-group lausanne_group
    access-list external_cryptomap_2 extended permit ip object-group DM_INLINE_NETWORK_4 object-group DPTNetwork
    access-list Guest_access_in extended deny tcp 192.168.3.0 255.255.255.0 object-group GuestDNS object-group DM_INLINE_TCP_3 inactive
    access-list Guest_access_in extended permit ip 192.168.3.0 255.255.255.0 object-group GuestDNS inactive
    access-list Guest_access_in extended permit ip 192.168.3.0 255.255.255.0 object-group DM_INLINE_NETWORK_2
    access-list Guest_access_in extended deny ip 192.168.3.0 255.255.255.0 10.5.64.0 255.255.240.0
    access-list Guest_access_in extended permit ip 192.168.3.0 255.255.255.0 any
    access-list Guest_access_out extended permit ip any any inactive
    access-list Guest_access_out extended permit ip any 192.168.3.0 255.255.255.0
    no pager
    logging enable
    logging buffer-size 1045786
    logging asdm informational
    mtu external 1500
    mtu internal 1500
    mtu Guest 1500
    mtu management 1500
    ip local pool HPVPNClients 10.5.79.0-10.5.79.254 mask 255.255.255.0
    ip verify reverse-path interface external
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any external
    icmp permit any internal
    asdm image disk0:/asdm-645.bin
    no asdm history enable
    arp external *142.189.93 0024.c4c0.4cc0
    arp timeout 14400
    nat (internal,external) source static dfb dfb destination static vpnpool vpnpool route-lookup
    nat (internal,external) source static dfb dfb destination static lausanne lausanne
    nat (internal,external) source static healthpoint healthpoint destination static Cegedim Cegedim
    nat (external,internal) source static DPTNetwork DPTNetwork destination static Crystal_ERP Crystal_ERP no-proxy-arp
    nat (internal,external) source static healthpoint healthpoint destination static DPTDocumentum DPTDocumentum unidirectional
    nat (internal,external) source static healthpoint healthpoint destination static DPTDocB DPTDocB unidirectional
    nat (internal,external) source static healthpoint healthpoint destination static EzDocs EzDocs unidirectional
    nat (internal,external) source static healthpoint healthpoint destination static DPTNotes DPTNotes unidirectional
    object network obj-10.5.65.239
    nat (internal,external) static *142.189.82
    object network obj-10.5.65.253
    nat (internal,external) static *142.189.83
    object network obj-10.5.65.42
    nat (internal,external) static *142.189.84
    object network obj-10.5.65.219
    nat (internal,external) static *142.189.87
    object network obj_any
    nat (internal,external) dynamic interface dns
    object network hpbexch
    nat (internal,external) static *142.189.91
    object network hpbmsvpn
    nat (internal,external) static *142.189.82
    object network kacehost
    nat (internal,external) static *142.189.90
    object network hpbsentry
    nat (internal,external) static *142.189.92
    object network hpbMDM
    nat (internal,external) static *142.189.93
    object network hperoom
    nat (internal,external) static *142.189.88
    object network spintranet
    nat (internal,external) static *142.189.85
    object network spsales
    nat (internal,external) static *142.189.89
    object network spteams
    nat (internal,external) static *142.189.94
    object network GuestNetwork
    nat (Guest,external) dynamic interface
    access-group external_access_in in interface external
    access-group external_access_out out interface external
    access-group Guest_access_in in interface Guest
    access-group Guest_access_out out interface Guest
    route external 0.0.0.0 0.0.0.0 *142.189.25 1
    route external 10.5.16.0 255.255.240.0 *142.189.25 1
    route external 10.5.32.0 255.255.240.0 *142.189.25 1
    route external 10.5.80.0 255.255.240.0 *142.189.25 1
    route external 10.5.128.0 255.255.240.0 *142.189.25 1
    route external 10.5.240.0 255.255.240.0 *142.189.25 1
    route external 10.5.250.0 255.255.255.248 *142.189.25 1
    route internal 172.18.0.0 255.255.255.255 10.5.64.1 1
    route external 192.168.250.0 255.255.255.0 *142.189.25 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server VPN-RADAuth protocol radius
    aaa-server VPN-RADAuth (internal) host 10.5.65.253
    key *****
    radius-common-pw *****
    aaa-server VPN-RADAuth (internal) host 10.5.65.240
    key *****
    aaa-server VPN-RADAuthHPB protocol radius
    aaa-server VPN-RADAuthHPB (internal) host 10.5.64.196
    key *****
    radius-common-pw *****
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    http server enable
    http 192.168.1.0 255.255.255.0 management
    http 10.5.0.0 255.255.0.0 internal
    http 0.0.0.0 0.0.0.0 external
    http 0.0.0.0 0.0.0.0 internal
    snmp-server host internal 10.5.65.210 community ***** version 2c
    snmp-server location Healthpoint.Vickery
    snmp-server contact Jonathan Henry
    snmp-server community *****
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto map external_map 1 match address external_cryptomap
    crypto map external_map 1 set peer 64.126.222.190
    crypto map external_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map external_map 2 match address external_cryptomap_1
    crypto map external_map 2 set pfs
    crypto map external_map 2 set peer 109.164.216.164
    crypto map external_map 2 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map external_map 3 match address external_cryptomap_2
    crypto map external_map 3 set peer 12.197.232.98
    crypto map external_map 3 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map external_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map external_map interface external
    crypto ca trustpoint _SmartCallHome_ServerCA
    crl configure
    crypto ca trustpoint ASDM_TrustPoint0
    keypair ASDM_TrustPoint0
    crl configure
    crypto ca certificate chain _SmartCallHome_ServerCA
    certificate ca 6ecc7aa5a7032009b8cebcf4e952d491
        308205ec 308204d4 a0030201 0202106e cc7aa5a7 032009b8 cebcf4e9 52d49130
        0d06092a 864886f7 0d010105 05003081 ca310b30 09060355 04061302 55533117
        30150603 55040a13 0e566572 69536967 6e2c2049 6e632e31 1f301d06 0355040b
        13165665 72695369 676e2054 72757374 204e6574 776f726b 313a3038 06035504
        0b133128 63292032 30303620 56657269 5369676e 2c20496e 632e202d 20466f72
        20617574 686f7269 7a656420 75736520 6f6e6c79 31453043 06035504 03133c56
        65726953 69676e20 436c6173 73203320 5075626c 69632050 72696d61 72792043
        65727469 66696361 74696f6e 20417574 686f7269 7479202d 20473530 1e170d31
        30303230 38303030 3030305a 170d3230 30323037 32333539 35395a30 81b5310b
        30090603 55040613 02555331 17301506 0355040a 130e5665 72695369 676e2c20
        496e632e 311f301d 06035504 0b131656 65726953 69676e20 54727573 74204e65
        74776f72 6b313b30 39060355 040b1332 5465726d 73206f66 20757365 20617420
        68747470 733a2f2f 7777772e 76657269 7369676e 2e636f6d 2f727061 20286329
        3130312f 302d0603 55040313 26566572 69536967 6e20436c 61737320 33205365
        63757265 20536572 76657220 4341202d 20473330 82012230 0d06092a 864886f7
        0d010101 05000382 010f0030 82010a02 82010100 b187841f c20c45f5 bcab2597
        a7ada23e 9cbaf6c1 39b88bca c2ac56c6 e5bb658e 444f4dce 6fed094a d4af4e10
        9c688b2e 957b899b 13cae234 34c1f35b f3497b62 83488174 d188786c 0253f9bc
        7f432657 5833833b 330a17b0 d04e9124 ad867d64 12dc744a 34a11d0a ea961d0b
        15fca34b 3bce6388 d0f82d0c 948610ca b69a3dca eb379c00 48358629 5078e845
        63cd1941 4ff595ec 7b98d4c4 71b350be 28b38fa0 b9539cf5 ca2c23a9 fd1406e8
        18b49ae8 3c6e81fd e4cd3536 b351d369 ec12ba56 6e6f9b57 c58b14e7 0ec79ced
        4a546ac9 4dc5bf11 b1ae1c67 81cb4455 33997f24 9b3f5345 7f861af3 3cfa6d7f
        81f5b84a d3f58537 1cb5a6d0 09e4187b 384efa0f 02030100 01a38201 df308201
        db303406 082b0601 05050701 01042830 26302406 082b0601 05050730 01861868
        7474703a 2f2f6f63 73702e76 65726973 69676e2e 636f6d30 12060355 1d130101
        ff040830 060101ff 02010030 70060355 1d200469 30673065 060b6086 480186f8
        45010717 03305630 2806082b 06010505 07020116 1c687474 70733a2f 2f777777
        2e766572 69736967 6e2e636f 6d2f6370 73302a06 082b0601 05050702 02301e1a
        1c687474 70733a2f 2f777777 2e766572 69736967 6e2e636f 6d2f7270 61303406
        03551d1f 042d302b 3029a027 a0258623 68747470 3a2f2f63 726c2e76 65726973
        69676e2e 636f6d2f 70636133 2d67352e 63726c30 0e060355 1d0f0101 ff040403
        02010630 6d06082b 06010505 07010c04 61305fa1 5da05b30 59305730 55160969
        6d616765 2f676966 3021301f 30070605 2b0e0302 1a04148f e5d31a86 ac8d8e6b
        c3cf806a d448182c 7b192e30 25162368 7474703a 2f2f6c6f 676f2e76 65726973
        69676e2e 636f6d2f 76736c6f 676f2e67 69663028 0603551d 11042130 1fa41d30
        1b311930 17060355 04031310 56657269 5369676e 4d504b49 2d322d36 301d0603
        551d0e04 1604140d 445c1653 44c1827e 1d20ab25 f40163d8 be79a530 1f060355
        1d230418 30168014 7fd365a7 c2ddecbb f03009f3 4339fa02 af333133 300d0609
        2a864886 f70d0101 05050003 82010100 0c8324ef ddc30cd9 589cfe36 b6eb8a80
        4bd1a3f7 9df3cc53 ef829ea3 a1e697c1 589d756c e01d1b4c fad1c12d 05c0ea6e
        b2227055 d9203340 3307c265 83fa8f43 379bea0e 9a6c70ee f69c803b d937f47a
        6decd018 7d494aca 99c71928 a2bed877 24f78526 866d8705 404167d1 273aeddc
        481d22cd 0b0b8bbc f4b17bfd b499a8e9 762ae11a 2d876e74 d388dd1e 22c6df16
        b62b8214 0a945cf2 50ecafce ff62370d ad65d306 4153ed02 14c8b558 28a1ace0
        5becb37f 954afb03 c8ad26db e6667812 4ad99f42 fbe198e6 42839b8f 8f6724e8
        6119b5dd cdb50b26 058ec36e c4c875b8 46cfe218 065ea9ae a8819a47 16de0c28
        6c2527b9 deb78458 c61f381e a4c4cb66
      quit
    crypto ca certificate chain ASDM_TrustPoint0
    certificate 4b54478c1754b7
        30820563 3082044b a0030201 0202074b 54478c17 54b7300d 06092a86 4886f70d
        01010505 003081ca 310b3009 06035504 06130255 53311030 0e060355 04081307
        4172697a 6f6e6131 13301106 03550407 130a5363 6f747473 64616c65 311a3018
        06035504 0a131147 6f446164 64792e63 6f6d2c20 496e632e 31333031 06035504
        0b132a68 7474703a 2f2f6365 72746966 69636174 65732e67 6f646164 64792e63
        6f6d2f72 65706f73 69746f72 79313030 2e060355 04031327 476f2044 61646479
        20536563 75726520 43657274 69666963 6174696f 6e204175 74686f72 69747931
        11300f06 03550405 13083037 39363932 3837301e 170d3131 30313036 31393533
        33395a17 0d313331 31323932 31343730 315a305b 311a3018 06035504 0a13112a
        2e686561 6c746870 6f696e74 2e636f6d 3121301f 06035504 0b131844 6f6d6169
        6e20436f 6e74726f 6c205661 6c696461 74656431 1a301806 03550403 13112a2e
        6865616c 7468706f 696e742e 636f6d30 82012230 0d06092a 864886f7 0d010101
        05000382 010f0030 82010a02 82010100 c6609ef2 c19c47e9 016ce654 d151146e
        5d213545 ca896f4e cbb2624c 5ea6d7f0 7f18a82b e441020b 74d6ebd4 b7ef34c9
        97b80ce0 6eb1c1cc 3b296909 8a0a2ad7 2473fb60 ff0c9320 ec9b3fe3 82a501c4
        3c3855bd e0822ce1 e1d1fb03 4609639f 9359653b 091b6b48 5ce22806 234a55e5
        6f80ebba cfb68a22 6cd1e64e 756f22b5 13a6178d 9ffcfbbb 5ca4b773 50089a8b
        7e966a23 d4711a49 44c101fc a6b68e26 6a8d57f3 2fed1f6f ce6b0535 498c5c97
        bf0577fa 9d9a1e37 4ff3b9f0 913dac74 3f4d26c9 09aac485 ccd5dfb9 7aa226e8
        89075829 eff0cf99 b642e679 5a9dfe74 e5899e30 e07b6bbf a92fab33 cb8d7f65
        1d974861 8b02d78b bc7908a9 e70b1b59 02030100 01a38201 ba308201 b6300f06
        03551d13 0101ff04 05300301 0100301d 0603551d 25041630 1406082b 06010505
        07030106 082b0601 05050703 02300e06 03551d0f 0101ff04 04030205 a0303306
        03551d1f 042c302a 3028a026 a0248622 68747470 3a2f2f63 726c2e67 6f646164
        64792e63 6f6d2f67 6473312d 32382e63 726c304d 0603551d 20044630 44304206
        0b608648 0186fd6d 01071701 30333031 06082b06 01050507 02011625 68747470
        733a2f2f 63657274 732e676f 64616464 792e636f 6d2f7265 706f7369 746f7279
        2f308180 06082b06 01050507 01010474 30723024 06082b06 01050507 30018618
        68747470 3a2f2f6f 6373702e 676f6461 6464792e 636f6d2f 304a0608 2b060105
        05073002 863e6874 74703a2f 2f636572 74696669 63617465 732e676f 64616464
        792e636f 6d2f7265 706f7369 746f7279 2f67645f 696e7465 726d6564 69617465
        2e637274 301f0603 551d2304 18301680 14fdac61 32936c45 d6e2ee85 5f9abae7
        769968cc e7302d06 03551d11 04263024 82112a2e 6865616c 7468706f 696e742e
        636f6d82 0f686561 6c746870 6f696e74 2e636f6d 301d0603 551d0e04 16041475
        346fa066 c4b0cb48 a6aaf4d5 d03124fd 1babaf30 0d06092a 864886f7 0d010105
        05000382 01010080 81fec403 103ecd08 88f17283 68154d3e 92da6355 58c50ea9
        b6d2a2d1 86428614 44b3f27b ae00352d 0339f481 22d2bc3c 1f7a8458 495a337f
        f939fa9d 76c9635c ac1f5452 8ec504ae 6c90dfc2 70e3b620 c34aedb3 12f8facd
        ce45e918 af358576 b6711324 f5d53b62 77c2bb0d 6ff7a26c 1863c7fe eae6ee42
        c1855066 e994db91 af755c47 b257545f ee29c6ab 57104a27 890f7f9c f95898c8
        ed30eda7 9e86ebd4 c6007d3b 640e2312 3875410b 79ddff84 11454b83 7126ebbb
        ce9c916a d5839e2b 095310e0 51e7e0cd d71c4830 ec1177c8 0407c147 afa2a33a
        d058fa1b de4b2771 8af206c6 27e17249 1afbd515 d3f2845d a3699196 a9a7044c
        5738a868 e01e59
      quit
    crypto ikev2 policy 1
    encryption aes-256
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    encryption des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev1 enable external
    crypto ikev1 policy 1
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 2
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 86400
    crypto ikev1 policy 3
    authentication pre-share
    encryption 3des
    hash sha
    group 1
    lifetime 86400
    crypto ikev1 policy 4
    authentication pre-share
    encryption 3des
    hash md5
    group 1
    lifetime 86400
    crypto ikev1 policy 10
    authentication crack
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 20
    authentication rsa-sig
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 30
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 40
    authentication crack
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 50
    authentication rsa-sig
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 60
    authentication pre-share
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 70
    authentication crack
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 80
    authentication rsa-sig
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 90
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 100
    authentication crack
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 110
    authentication rsa-sig
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 130
    authentication crack
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 140
    authentication rsa-sig
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 150
    authentication pre-share
    encryption des
    hash sha
    group 2
    lifetime 86400
    telnet 10.5.0.0 255.255.0.0 internal
    telnet 192.168.1.0 255.255.255.0 management
    telnet timeout 5
    ssh 10.5.0.0 255.255.0.0 internal
    ssh timeout 5
    console timeout 0
    no vpn-addr-assign aaa
    no vpn-addr-assign dhcp
    dhcpd address 192.168.1.2-192.168.1.254 management
    dhcpd enable management
    threat-detection basic-threat
    threat-detection statistics port
    threat-detection statistics protocol
    threat-detection statistics access-list
    threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
    ntp server 10.5.65.242 source internal
    ssl trust-point ASDM_TrustPoint0 external
    webvpn
    enable external
    enable internal
    anyconnect-essentials
    anyconnect image disk0:/anyconnect-win-2.5.0217-k9.pkg 1
    anyconnect profiles HP_Basic disk0:/HP_Basic.xml
    anyconnect enable
    tunnel-group-list enable
    group-policy DfltGrpPolicy attributes
    vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-clientless
    group-policy GroupPolicy1 internal
    group-policy GroupPolicy1 attributes
    vpn-tunnel-protocol ikev1 ikev2
    group-policy HPVPN internal
    group-policy HPVPN attributes
    banner value You are now connected to Healthpoint, Ltd.
    wins-server none
    dns-server value 10.5.64.199 10.5.64.197
    dhcp-network-scope none
    vpn-idle-timeout none
    vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec ssl-client ssl-clientless
    ip-comp disable
    ipsec-udp enable
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value split
    default-domain value hpb.net
    split-dns none
    split-tunnel-all-dns disable
    user-authentication-idle-timeout none
    address-pools value HPVPNClients
    client-firewall none
    client-access-rule none
    webvpn
      anyconnect keep-installer installed
      anyconnect ssl compression none
      anyconnect profiles value HP_Basic type user
      anyconnect ask enable default anyconnect timeout 5
      http-comp none
    username bcline password Wpo.Polan03mKRJ9 encrypted privilege 15
    username jhenry password wX50UveiwuBH7p7v encrypted privilege 15
    username ittemp password zpQoWfp93rOS3NU7 encrypted privilege 5
    tunnel-group HPVPN type remote-access
    tunnel-group HPVPN general-attributes
    address-pool HPVPNClients
    authentication-server-group VPN-RADAuth
    authentication-server-group (external) VPN-RADAuth
    default-group-policy HPVPN
    password-management password-expire-in-days 3
    tunnel-group HPVPN webvpn-attributes
    group-alias HPVPN enable
    tunnel-group HPVPN ipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group 64.126.222.190 type ipsec-l2l
    tunnel-group 64.126.222.190 ipsec-attributes
    ikev1 pre-shared-key *****
    ikev2 remote-authentication pre-shared-key *****
    ikev2 local-authentication pre-shared-key *****
    tunnel-group 109.164.216.164 type ipsec-l2l
    tunnel-group 109.164.216.164 ipsec-attributes
    ikev1 pre-shared-key *****
    ikev2 remote-authentication pre-shared-key *****
    ikev2 local-authentication pre-shared-key *****
    tunnel-group 12.197.232.98 type ipsec-l2l
    tunnel-group 12.197.232.98 ipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group HPB type remote-access
    tunnel-group HPB general-attributes
    address-pool HPVPNClients
    authentication-server-group VPN-RADAuthHPB
    authentication-server-group (external) VPN-RADAuthHPB
    default-group-policy HPVPN
    password-management password-expire-in-days 3
    tunnel-group HPB webvpn-attributes
    group-alias HPB disable
    group-alias HPVPN_NEW enable
    tunnel-group HPB ipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group HPB ppp-attributes
    authentication ms-chap-v2
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
      no dns-guard
    policy-map global_policy
    class inspection_default
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
      inspect icmp
      inspect dns
    service-policy global_policy global
    prompt hostname context
    service call-home
    call-home reporting anonymous
    call-home
    contact-email-addr
    profile CiscoTAC-1
      destination address
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:f3c293700f62ee55af87105015fe4cd0
    : end

    You have to options:
    1. The router that is internal must have a static route to the ASA to reach the VPN networks and must have a distribute static so that other routers that form part of EIGRP know how to route to the VPN networks.
    2. You can configure on the ASA "set reverse-route" on the crypto map then configure EIGRP on the ASA and add redistribute static so that routes learned via VPN (considered static routes) can be pushed through EIGRP.

  • One Time Password (OTP) on mobile/email required in Oracle Apps R12

    Dear All,
    Good Day! Hope you all are doing well.
    My management needs OTP on mobile/email for log-in into Oracle APPs R12 for some key users in our Organization.
    Let me explain the requirement is detail, When user log-in to oracle apps by entering his/her user name and password then system send an email or send sms on mobile for One time password. When user provide this OTP then he is able to log-in to the Oracle Apps.
    Any body have some idea then please guide.
    Regards,
    Saquib.

    Hi,
    Based on our experience, if the NTLM error occurs, please check the password.
    Regards,
    Mike
    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

  • Publish RD Gateway and Web Access with One-Time Password (OTP) / Two-factor Authentication WITHOUT ISA/TMG server

    Hi everybody,
    I've been struggeling with this problem for a few weeks now and can't find a way to solve it.
    We have an RD farm (Server 2012) which consists of two Remote Desktop Servers with Connection Broker and Web Access.
    I've recently published a new server, containing RD Gateway and Web Access in our perimeter network.
    Now we've got restrictions that OTP/2FA must be used for the external deployment and we've decided to go for a solution from Gemalto.
    The "program" is called IDConfim and the server is called SA Server (Strong Authentication).
    Also it's important that NO ISA/TMG server is supposed to be used, the OTP/2FA is supposed to work seamless with the Web Access/Gateway.
    After hours discuss we came to a point were their NPS agent setup would be the only way to accomplish our goals.
    The setup is supposed to be like this:
    LAN:
    1 DC (2008 R2)
    RD Farm (2012)
    1 SA Server (2012)
    DMZ:
    RD Gateway/Web Access (2012)
    Were Gateway and Web Access should forward the authentications with NPS to the NPS agent on the SA server.
    When you print your AD account to authenticate you add the 6 digits of OTP which you recieve from you mobile app.
    Initially this seems to work, the Gateway forwards the request to the remote NPS server, BUT only if you write the correct AD password
    (without the OTP extension).
    If you write the correct AD password the authentication is forwarded to out SA Servern and it's beeing rejeced because the password doesn't
    contain the correct OTP extension.
    The problem comes here.
    When you write you AD password along with the OTP extension you get a Windows Security error in the eventlog (On thw Gateway server) like this:
    An account failed to log on.
    Subject:
    Security ID: NULL SID
    Account Name: -
    Account Domain: -
    Logon ID: 0x0
    Logon Type: 3
    Account For Which Logon Failed:
    Security ID: NULL SID
    Account Name: user
    Account Domain: domain
    Failure Information:
    Failure Reason: Unknown username or password.
    Status: 0xc000006d
    Sub Status: 0x0
    Process Information:
    Caller Process ID: 0x0
    Caller Process Name: -
    Network Information:
    Workstation Name: server
    Source Network Address: 192.168.x.x
    Source Port: 63003
    Detailed Authentication Information:
    Logon Process: NtLmSsp
    Authentication Package: NTLM
    Transited Services: -
    Package Name (NTLM only): -
    Key Length: 0
    This event is generated when a logon request fails. It is generated on the computer where access was attempted.
    The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
    The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).
    The Process Information fields indicate which account and process on the system requested the logon.
    The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
    The authentication information fields provide detailed information about this specific logon request.
    - Transited services indicate which intermediate services have participated in this logon request.
    - Package name indicates which sub-protocol was used among the NTLM protocols.
    - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
    What i can see it's a NTLM error, but hey?! aren't we supposed to forward all authentication handeling to the remote NPS server?
    The problem is that no matter what i try the above problem stays there.
    Is it not possible to just forward ALL authentication handeling to a remote server?
    The only solution I've found to get it working someday in the future is this:
    "Remote Desktop Pluggable Authentication and Authorization", which is supposed to be introduced in 2012 R2.
    Also this link describes it:
    http://archive.msdn.microsoft.com/Release/ProjectReleases.aspx?ProjectName=rdsdev&ReleaseId=3745
    Please, bring me some answers before my head explodes! :)
    PS, long question = maybe some errors, ask me if something is unclear.

    Hi,
    Based on our experience, if the NTLM error occurs, please check the password.
    Regards,
    Mike
    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

  • How do you Redistribution EIGRP into OSPF and maintain a distance of 250 for a static route?

    Ok, I have scoured the forums long enough and have to post. The design is below. I moved a firewall to our new data center, which required adding some static routes for VPN connections and broadband backups. To minimize the amount of static routes I redistribute static into EIGRP with a route-map and prefix-list.
    My problem is the next part of my network. When the data leaves my 56128's it hits an edge device connecting to our dark fiber. On this edge device I am running OSPF onto the dark fiber, then redistribute some EIGRP subnets into OSPF and again all is well.
    Everything works up until the point the redistributed routes hit my RIB at my main data center where I am running IBGP. IBPG is run between our MPLS router and core for all our remote sites. When my backup route from the 56128's hits the cores, it supersedes the BGP route because the AD route O E2 [110/20] is lower than the BGP AD B [200/0]. Given the configuration below what can be done to remedy this? Oh when I redistribute I can only change the AD for the backup routes, all other routes should stay the same.
    56128's where my static routes are:
    ip route 192.168.101.0/24 192.168.30.77 name firewall 250
    router eigrp 65100
       redistribute static route-map Static-To-Eigrp
    route-map Static-To-Eigrp permit 10
       match ip address prefix-list Static2Eigrp
    ip prefix-list Static2Eigrp seq 2 permit 192.168.101.0/24
    Edge device:
    router eigrp 65100
     network 172.18.0.5 0.0.0.0
     network 172.18.0.32 0.0.0.3
     network 172.18.0.36 0.0.0.3
     redistribute ospf 65100 metric 2000000 0 255 1 1500
     redistribute static metric 200000 0 255 1 1500 route-map STATICS_INTO_EIGRP
     passive-interface default
     no passive-interface Port-channel11
     no passive-interface Port-channel12
     eigrp router-id 172.18.0.5
    router ospf 65100
     router-id 172.18.0.5
     log-adjacency-changes
     redistribute eigrp 65100 subnets route-map EIGRP_INTO_OSPF
     passive-interface default
     no passive-interface GigabitEthernet1/0/1
     no passive-interface GigabitEthernet1/0/2
     no passive-interface GigabitEthernet2/0/1
     no passive-interface GigabitEthernet2/0/2
     network 172.18.0.0 0.0.255.255 area 0
    ip prefix-list EIGRP_INTO_OSPF seq 5 permit 172.18.0.0/16 le 32
    ip prefix-list EIGRP_INTO_OSPF seq 10 permit 192.168.94.0/29 le 32
    ip prefix-list EIGRP_INTO_OSPF seq 15 permit 192.168.26.32/29 le 32
    ip prefix-list EIGRP_INTO_OSPF seq 20 permit 192.168.30.72/29 le 32
    ip prefix-list EIGRP_INTO_OSPF seq 25 permit 192.168.20.128/25 le 32
    ip prefix-list EIGRP_INTO_OSPF seq 26 permit 192.168.101.0/24 le 32 <- Backup Route for MPLS Remote Office
    route-map EIGRP_INTO_OSPF permit 10
     match ip address prefix-list EIGRP_INTO_OSPF

    So in the case of a /24. If it were say broken up into /25's? From our remote sites we are using aggregate-address summary-only. Not sure how I would advertise a more specific route via BGP, sorry.
    I didnt have this problem until I moved my firewalls. They plugged into the cores where IBGP was running and the static never kicked in unless the bgp route disappeared. I guess I could use my static redistribution for my VPN sites and use statics across the cores for the handful of backup links I have.

  • Eigrp routes doesn't refresh when neighbor down

    hi guys, need some tips for troubleshooting an ongoing issue, but can't do the changes anymore untill next call and yes the issue is still ongoing.
                           WAN1 <--------------------------------------------------------------------------------------------> WAN2
                               |                                                                                                                                       |  
                       metro ethernet ME-3600X-A  <----> ME-3600X-B  <----->  ME-3600X-C<----> c3560v2
    I have 3 metro ethernet switches and a c3560v2 switch connected as above. The WAN1 redistributes all routes to ME-3600X-A's eigrp and WAN2 redistributes all routes to c3560v2 's eigrp and these two propagates all their eigrp routes to ME-3600X-B and ME-3600X-C  which are in the same eigrp AS. And all link/connections are point-to-point.
    Now, when the link between ME-3600X-B  <----> ME-3600X-C is physically disconnected, the ME-3600X-C's eigrp still points the route(s) to the ME-3600X-B's p2p ip as its next-hop - which is down(neighborship between them goes down, but still the routes doesn't refresh/rebuild). However, switch c3560v2 has route to the same network learnt from WAN2.
    Wonder why, need inputs please? Thanks.

    You shouldn't reference the CrystalReportViewer in the Page_Load handler, since there's issues with serialization of the report source:
    http://devlibrary.businessobjects.com/BusinessObjectsXIR2SP2/
    en/en/CrystalReports_dotNET_SDK/crsdk_net_doc/doc/
    crsdk_net_doc/html/
    crconsdkfundamentalspersistencepageloadeventhandler.htm
    In fact, you should save the report source in session, and bind it to the viewer on post-back.  Sample code can be found here:
    http://resources.businessobjects.com/support/communitycs/
    FilesAndUpdates/sample_applications_for_.NET_developers.pdf
    Sincerely,
    Ted Ueda

  • How to change AD of specific routes in EIGRP NX-OS 6.2

    Hi,
    I need some help in converting following IOS config to NX-OS
    router eigrp 10
     distance 18 10.16.0.16 0.0.0.7 bgp_acl  <-----
     distance 18 10.16.0.24 0.0.0.7 distance_18     <-----
     no auto-summary
    ip access-list standard distance_18
     permit 10.1.1.1
     permit 10.14.52.0
     permit 10.13.52.0
     permit 10.106.1.1
    ip access-list standard bgp_acl
     permit 10.1.1.1
     permit 10.106.1.1
    how do I change administrative distance of specific routes in NX-OS learned from sources specified in distance command?
    In NX-OS I see that distance command changes AD globally for all internal and external routes.
    Thank you

    This is what I have finalized. first I tried with 2 prefix-list to match for routes but route-map has limitation and you can't use 2 address type prefix-lists.
    router eigrp 10
    address-family ipv4 unicast
    table-map vpls-route-AD
    route-map vpls-route-AD permit 10
    match ip route-source prefix-list vpls-route-source
    match ip address prefix-list vpls-route
    set distance 18
    ip prefix-list vpls-route-source seq 5 permit 10.16.0.16/29
    ip prefix-list vpls-route-source seq 10 permit 10.16.0.24/29
    ip prefix-list vpls-route seq 15 permit 10.13.52.0/24
    ip prefix-list vpls-route seq 20 permit 10.14.52.0/24
    ip prefix-list vpls-route seq 25 permit 10.1.1.1/32
    ip prefix-list vpls-route seq 30 permit 10.106.1.1/32

  • DOES EIGRP USE AS NUMBER/process number as it's PORT NUMBER between the routers in the same AS/group?

    in this posthttps://supportforums.cisco.com/discussion/9805551/eigrp-port-number  there is an answer which seems a little weird, the question asks about the EIGRP port number, and someone answers that "The port number is the EIGRP AS."
    I goggled all over the net but could not find any single clue about it!! is that really so, I mean DOES EIGRP USE AS NUMBER AS PORT NUMBER?
    I know stuff about routing, EIGRP,RTP and so on, please don't state the obvious and just give some link to some document on Cisco, about this subject.
    BTW there's a link under the mentioned post but it doesn't load, I don't know, anyway thank you

    in this posthttps://supportforums.cisco.com/discussion/9805551/eigrp-port-number  there is an answer which seems a little weird, the question asks about the EIGRP port number, and someone answers that "The port number is the EIGRP AS."
    I goggled all over the net but could not find any single clue about it!! is that really so, I mean DOES EIGRP USE AS NUMBER AS PORT NUMBER?
    I know stuff about routing, EIGRP,RTP and so on, please don't state the obvious and just give some link to some document on Cisco, about this subject.
    BTW there's a link under the mentioned post but it doesn't load, I don't know, anyway thank you

  • Error building Erlang/OTP

    I'm building Erlang/OTP R12B-4(*) on a T1000 server and seeing this error:
    gcc: Internal error: Segmentation Fault (program cg)
    Please submit a full bug report to
    <URL:http://forum.java.sun.com/forum.jspa?forumID=905>.
    I had the same error with the 4.0.3 which came installed on the system.
    The context of the error is:
    gcc -g -O3 -fomit-frame-pointer -I/usr/local/src/otp_src_R12B-4/erts/sparc-sun-solaris2.10 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -DERTS_SMP -DHAVE_CONFIG_H -Wall -Wstrict-prototypes -Wmissing-prototypes -Wdeclaration-after-statement -DUSE_THREADS -D_THREAD_SAFE -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wa,-xarch=v8plusa -Ibeam -Isys/unix -Isys/common -Isparc-sun-solaris2.10/opt/smp -Isparc-sun-solaris2.10 -Izlib -Ipcre -Ihipe -I../include/internal -I../include/internal/sparc-sun-solaris2.10 -c beam/erl_bif_info.c -o obj/sparc-sun-solaris2.10/opt/smp/erl_bif_info.o
    gcc: Internal error: Segmentation Fault (program cg)
    Please submit a full bug report to
    <URL:http://forum.java.sun.com/forum.jspa?forumID=905>.
    make[3]: *** [obj/sparc-sun-solaris2.10/opt/smp/erl_bif_info.o] Error 1
    make[3]: Leaving directory `/usr/local/src/otp_src_R12B-4/erts/emulator'
    make[2]: *** [opt] Error 2
    make[2]: Leaving directory `/usr/local/src/otp_src_R12B-4/erts/emulator'
    make[1]: *** [smp] Error 2
    make[1]: Leaving directory `/usr/local/src/otp_src_R12B-4/erts'
    gmake: *** [emulator] Error 2
    (*) http://erlang.org/download/otp_src_R12B-4.tar.gz

    $ gcc --version
    sparc-sun-solaris2.10-gcc (GCC) 4.0.3 (gccfss)
    This is the version installed with the latest Solaris 10 5/09:
    vances@earl$ pkginfo -l SUNW0gccfss
    PKGINST: SUNW0gccfss
    NAME: GCC for SPARC(R) Systems
    CATEGORY: application
    ARCH: sparc
    VERSION: 4.0.3
    BASEDIR: /opt
    PSTAMP: sacrum20061020151241
    INSTDATE: Jan 13 2009 22:10
    STATUS: completely installed
    FILES: 538 installed pathnames
    7 linked files
    62 directories
    31 executables
    354905 blocks used (approx)
    The Erlang/OTP source distribution is available here:
    http://erlang.org/download.html

  • Interview question: EIGRP and Grandmother

    Hi all.
    A question was asked to me a couple of months ago during an interview. I'm quite curious as to how others would respond to it. Here it is.
    "If I was your grandmother, how would you make me understand EIGRP?"
    I know that when the interviewer says "make me understand", it doesn't mean you should go deep into the details of the IGP. Maybe just a bird's eyeview. But still, makes you think.

    I guess I'd have to relate it to something my grandmother would understand.  I know she would be lost as soon as I said IP.
    I would probably relate to driving in her car to get to the grocery store.  Imagine if it every corner there was a traffic guard directing traffic, and every traffic guard had a map with the fastest way to get to her destination in his hand.  When she gets to that intersection the traffic guard tells her which way to go.  As long as all the roads are working the path she takes to the store pretty much remains the same.  Now imagine that all of these guards have walkie-talkies in their hands, and if there is an accident on a road, and that road is closed that guard announces to all the other traffic guards that that road is closed and and the traffic guards are quickly able to give you an alternate route before you get stuck in traffic.  The good thing about EIGRP is that these updates to traffic patterns are only sent periodically instead of all the time, this greatly reduces the amount of communication over the walkie-talkies, making it much easier for other communication to pass over them as well, while keeping everyone updated on what the best path to take to the store is.
    I like trying to use analogies in my explanations to my end users.  It puts the context of your discussion into terms that they can relate to and understand the general concept of.  An interviewer might be asking you to do this to show, that you not only can regurgitate the answer that they're looking for, but understand it well enough to break it down into simpler terms that can be communicated to someone without technical knowledge that can still be understood.
    I report to the VP of Finance/CFO here at my organization.  I find myself constantly having break down complicated terms into something that he can understand in order to get budget approval for projects.  I'm guessing your interviewer wanted to be sure you had the skills to be able to communicate complex IT concepts with someone who may not understand the "dictionary" explanation?

  • Metrics when redistributing a static default route into EIGRP?

    I saw a network working with EIGRP and resdistributing a static default route into it. I did not find the "default metrics" to redistribute into EIGRP but the static default route works and is redistributed. My understanding was that everytime you redistribute into EIGRP you needed to specify the metrics. How come this network is working? Can someone explain or point to a cisco document what explains it?
    Sample of the config:
    router eigrp 1
    redistribute static
    no autosummary
    network Y.Y.Y.Y
    ip route 0.0.0.0 0.0.0.0 X.X.X.X
    Thank you,

    It's just one of those specific things about EIGRP and IOS, maybe a design choice. If they do use the interface as the seed metric then that would help explain why it's that way.
    Weirdly if you are using EIGRP VRF address family configuration on IOS and you redistribute statics you do need a metric.
    And I believe NXOS running on Nexus switches also needs a metric defined.
    Just one of those things you have to remember but it would be good if it was consistent.
    Jon

Maybe you are looking for