Enabling ICMP on cisco acs1120
Hi All ,
We have downgraded cisco acs appliance 1120 from ACS 5.0 to ACS 4.2.1.15 , when we perform ICMP ping request to acs appliance its not responding , But i can do ping test from acs appliance on console mode not from GUI mode .
Is there any option to enable ICMP Ping response on cisco acs 1120 . else any patch to be upgraded to perform this action , my requirement is enable ICMP ping on acs appliance for troubleshooting . instead always check with telnet x.x.x.x 2002 for service responding
Hi Santosh,
The pathc available on cisco.com download page.
The path is as follows:
www.cisco.com > support > download software >Products > Security > Identity Management > Cisco Secure Access Control Server Solution Engine > Cisco Secure Access Control Server Solution Engine 4.2 > Secure Access Control Server (ACS) Solution Engine > 4.2.0.124.
the patches are as follows:
appl_Acs4.x_PingTurnOff_With_CSAgentUpdate_1_Patch.zip
appl_Acs4.x_PingTurnOn_With_CSAgentUpdate_1_Patch.zip
You will need a valid software download contract to download the patches.
Hope this helps.
Regards,
Anisha
P.S.: please mark this thread as answered if you feel your query is resolved. Do rate helpful posts.
Similar Messages
-
Internet Sloww after enabling IPS on Cisco 5510
I have recently enabled IPS on Cisco 5510, after we are experiencing slow internet respond. We are sending all traffic to IPS for analysis.
Based on your needs, configuration and equipment; yes, that can happen with IPS. What's your question?
-
Enabling NPIV in CISCO MDS 9500 Series
Hello!!!
If i could get the response for my query.
I need to enable NPIV as we have VM's to be created and allocate SAN storage to them so my CISCO MDS needs to have NPIV enabled. Following queries linked with this:
1. Can i enabled NPIV on single Fibre Channel Port or it gets enabled on the complete SAN Switch
2. Does enabling NPIV impact any other SAN operation. Also my 2- sites are connected via ISL, so is it important to enable NPIV across all my sites or i can enable it only at 1 site where my VM hosts are located.
3. Any reference document for NPIV and related zoning concept.
Thanks in advance.
Faizul Mufti
9958766711Hi,
1. Can i enabled NPIV on single Fibre Channel Port or it gets enabled on the complete SAN Switch
whole switch
feature npiv
2. Does enabling NPIV impact any other SAN operation. Also my 2- sites are connected via ISL, so is it important to enable NPIV across all my sites or i can enable it only at 1 site where my VM hosts are located.
Will not impact any other SAN operation. Non-disruptive.
"feature npiv" is local to the switch, not fabric wide. Use this command on any switch you want multiple flogi's on a single interface.
3. Any reference document for NPIV and related zoning concept.
I suggest zoning by pwwn
Regards,
David -
Block / Deny ICMP Traffic cisco asa 5512-x
hi expert
I have cisco asa 5512x for configure as firewall and sslvpn.
my customer want block/Deny icmp traffic from interface outside without block anything.
i've configure form cli :
icmp deny any outside
but from outside can't open sslvpn url and asdm.Hi,
Access for the Anyconnect/ASDM does not depend on the ICMP permit/deny commands on the ASA device.
If you want to block the Pings to the ASA interface use the command:-
icmp deny any outside etc.
What do you mean by "i can ping from outside." Plzz explain.
Thanks and Regards,
Vibhor Amrodia -
How to keep a Fabric port always enable in a Cisco MDS 9000 Switch?
Dear members:
I work in Datacenter automation solutions using most part of time Virtualization softwares.
I'm having an interst problem with a server while it is booting thru SAN using a logical volume stored in a EMC DMX4 array.
We are trying to boot a VMWare ESX 4.1 OS, but when OS tries to change HBA BIOS driver to ESX device driver during boot process, the Server's HBA logged off from MDS Fabric that it is connected, ESX can't boot and I got a ESX standard prompt.
I think that problem is becuase ESX 4.1 is taking too long to load Storage Drivers during boot process and the consequences is HBA logged off from Fabric.
I already tried to change FLOGI parameters in HBA and Topology architecture, but I didn't have success.
If a try to boot a Microsoft OS like Windows 2008, I don't have this behavior, and OS can boot from SAN without any problem.
Please, if anyone have any idea about how to keep fabric port always enabled, let me know. Any idea or help is very welcome.
Best Regards.
Alexandre NicolauHi,
You can take a look at this document:
http://www.cisco.com/en/US/docs/solutions/Enterprise/WAN_and_MAN/QoS_SRND_40/QoSCampus_40.html#wp1099352
Hope this helps, please rate if it does.
Kind regards,
- Adrian. -
How do you configure ssh on Cisco 4507 ? I did "show ip ssh" and the log below is displayed as a result.
Router#show ip ssh
SSH Disabled - version 1.99
%Please create RSA keys to enable SSH (and of atleast 768 bits for SSH v2).
Authentication timeout: 120 secs; Authentication retries: 3
Minimum expected Diffie Hellman key size : 1024 bits
IOS Keys in SECSH format(ssh-rsa, base64 encoded): NONE
Thanks.Hi,
Check this link..
http://www.cisco.com/en/US/tech/tk583/tk617/technologies_tech_note09186a00800949e2.shtml
aaa related commands are not mandatory. You can even use local authentication. Also, make sure the IOS supports SSH.
Do 'Shoe version' the IOS name contains 'k9' for crypto.
hth
MS -
Enable "linemode" on Cisco IOS device
Hi Experts,
I would like to monitor some telnet traffic with a tcpdump/wireshark. As I know because of the mode between Telnet Client and Telnet Server these "double-characters" appears (when client type something):
From Cisco device we can connect to another device in line mode with a command like this:
connect 10.0.0.1 /line
But is there a way to use this option on all my VTY lines, on my AccessServer (2811 router)?Hi,
There isn't any specific command to activate a tunnel using 3DES and the only thing is, the isakmp and ipsec policies should match on both the sides, which you are already aware of.
Regards,
Arul -
Need assistance in Ciscoworks LMS 3.2 for enable monitoring of cisco switches
Hello,
I am new to the ciscoworks LMS 3.2. I have a task to add a devices in ciscoworks and configure the SNMP on the devices and ciscoworks both. My company has bought the ciscoworks LMS3.2 in 2009 december since then one engineer has configured some devices in it but not fully. I tried to look into the guides and documentation but has huge stuff. My infrastructure lead also not familiar of ciscoworks tool. I know there is lot of documentation in it but I have very less time say this weekend I have to activate monitoring of devices in ciscoworks LMS 3.2. Can anyone please provide me the screenshots or step-by-step procedure to how to enable a device for monitoring who has prior experience on ciscoworks LMS 3.2.
Regards,
AhmedRegarding SNMP reachabilty, you are the man........ thats true the firewall is blocking, because the subnets for the swithces which i m trying to add into the ciscoworks are not added into the firewall. Those subnets are different than the other 20 switches which are shown as reachable.
and regarding the swithces which are already seen reachable, based on the document you have provided me for alert and monitoring of a device. I checked the DFM and configured as it is but still i didn't see any of the alert when I turned off one of the 4506E power supply. Is there something I am missing it.
What do you need from my side to provide information or screenshot so that we can sort out the issue of monitoring of the device. Should I get an alert even if the device goes down?
regards
Ahmed -
Hey,
I am trying to change the enable password on cisco ASA 5510. I run enable password <password>. I log off, and log back in with my username/password and type en, it asks for a password and enter the password that I just set but it does not work.
what am I missing?
ThanksAre you using the local user database or a TACACS or RADIUS server to authenticate?
If using a TACACS or RADIUS server enter your user password when you type enable. If that doesn't work disconnect the TACACS or RADIUS server and try to enter the enable password you created.
If using the local user database, are you sure that you are entering the password correctly? Perhaps you typed it incorrectly when creating it and accidentally put a space at the begining or end?
If non of the above work then you will need to perform a password recovery:
Reboot your ASA
Press the Esc key to enter ROMON mode when prompted
Change the configuration register value to 0x41 by using the command confreg 0x41
To tell the ASA to ignor the startup configuration issue the command confreg
Current Configuration Register: 0x00000041
Configuration Summary:
boot default image from Flash
ignore system configuration
Do you wish to change this configuration? y/n [n]: y
5. At the prompt enter Y
6. Accept all default values when prompted
7. Reload the ASA by enter the command boot
8. When prompted enter enable and leave the password blank
9. Issue the command copy start run
10. Enter configuration mode configure terminal
11. Enter the command no config-register (the value is returned to its default value of 0x1)
12. Save your configuration copy run start
Please remember to rate and select a correct answer -
Try this:
enable secret 0 cisco
service password encryption.
The 5 in the command above says the password that follows is an encrypted password. After the service command the passwords should get encrypted in the configuration.
vel 5 with password ‘password’
#enable secret level 5 ?
0 Specifies an UNENCRYPTED password will follow
4 Specifies an SHA256 ENCRYPTED secret will follow
5 Specifies a MD5 ENCRYPTED secret will follow
LINE The UNENCRYPTED (cleartext) ‘enable’ secretIf I type in: switch# "enable secret 5 cisco"
and I exit out of global config mode and priv exec mode and then I type in "enable" I get prompted for the password and I type in "cisco" it asks for the password again, until finaly it says "bad secrets". What did I do wrong?
However if I type in "enable password cisco" and go back into "enable" I type in the password and I can get into priv exec mode no problem.
whats the problem?
This topic first appeared in the Spiceworks Community -
No Audio on either end Cisco Jabber for Windows over Cisco AnyConnect
Our telephony staff is replacing our aging/unsupported VoIP system with a Cisco system and as the network tech, I'm trying to get Jabber for Windows to work over our AnyConnect VPN client. Jabber to Cisco phone and Jabber to Jabber calls work fine within our LAN.
However, when I take a laptop to a separate internet connection and connect to the network via the VPN, I can't get any audio to pass across the system, in either direction. If I call a phone on our LAN using the Jabber client (via AnyConnect), the phone rings and when I answer it, it's just dead air on both ends. If I reverse the process, calling from the phone to the Jabber client, the same thing, Jabber client rings, but dead air both ways once I answer.
Things I can do from the laptop over the VPN connection:
I'm able to get to the phone's web interface using that same laptop.
I can ping the phone as well. In fact, the VPN profile I'm using has full access to the entire VoIP Vlan including all IP traffic (all ~65,000 ports).
Searching the address book also works fine. I can search for staff and it's pulling directly from our Active Directory environment.
Is there any special settings on the firewall that I need to setup to allow the voice traffic (which I assume is RTP traffic)? I tried to add a service policy for RTP traffic, but that didn't seem to work...unless I built it wrong.
Jabber for Windows - 10.6.0
Cisco Anyconnect - 3.1.06079
Cisco 5515-x ASA - 9.2I was able to resolve this on my own. I thought that SIP traffic needed to be inspected via the global inspection policy in order for it to pass through the firewall. I ran into the same issue with ICMP traffic from an Anyconnect client to LAN devices. I had to enable ICMP in that policy for us to be able to ping LAN devices over the VPN tunnel. So when I saw that SIP was already being inspected by this policy, I moved on looking for other solutions. Then I stumbled deep within a Google search (almost hit the end of the Internet doing so) where someone mentioned that SIP shouldn’t be inspected by that policy. So I unchecked it and bam! Voice is now working over the anyconnect client to phones on the LAN.
-
Cisco ASA 5505 - 2 internal Networks
Hi new to ASA's,
Been trying to get the following setup working for ages but can't see what I am missing:
(Got image from another post but exactly what I want but cannot get working)
I can get ping between subnets but nothing else and Lan 2 cannot get to internet.
The reolution for this guy was the following I believe; (from his config he has ASA v8.2)
same-security-traffic permit intra-interface
access-list NONAT permit ip 192.168.50.0 255.255.255.0 10.0.50.0255.255.255.0
access-list NONAT permit ip 10.0.50.0 255.255.255.0 192.168.50.0 255.255.255.0
nat (inside) 0 access-list NONAT
I have tried this but I have ASA v8.4 and whilst commands 1 - 3 work command 4 doesn't.
I get a message about the command being deprecated. I couldn't find a new version I could understand.
Hope nothing stupid and simple but any help greatly appreciated.
BTW, I have reset my ASA back to defaults except internet access is working and internet LAN as I made some many changes I feared one my conflict with the other.
Many thanks for any views or help.Hi Jumora,
Thanks for the reply.
The 192 network behind the ASA can access the internet but the 10 network past the 1841 router can't.
I have setup tcp bypass already as that got me at least remote access to the PC's on the 10 network from the 192 network.
I had the 1841 router set to use the interface on the 192 subnet as the route to the 0.0.0.0 0.0.0.0 network but I couldn't get out but have just changed this to go to the inside interface of the ASA and can now ping 8.8.8.8 for example but still not internet access.
Also I have found that the ASA seems to occasionally when it feels like it block pings from the 10 subnet to devices in the 192 subnet...... annoying for testing! but I can still access shares even though the ping fails.
e.g. as per above yesterday it stopped when I enabled icmp error inspection but when I switched that off it worked again. Then suddenly again today with no changes it has stopped working again, drives me nuts the inconsistency!
I couldn't find an attach option for the show tech so it has made this post massive.... apologies for that....
ASA5505# show tech
Cisco Adaptive Security Appliance Software Version 8.4(4)1
Device Manager Version 6.4(9)
Compiled on Thu 14-Jun-12 11:20 by builders
System image file is "disk0:/asa844-1-k8.bin"
Config file at boot was "startup-config"
ASA5505 up 8 days 23 hours
Hardware: ASA5505, 512 MB RAM, CPU Geode 500 MHz
Internal ATA Compact Flash, 128MB
BIOS Flash M50FW016 @ 0xfff00000, 2048KB
Encryption hardware device : Cisco ASA-5505 on-board accelerator (revision 0x0)
Boot microcode : CN1000-MC-BOOT-2.00
SSL/IKE microcode: CNLite-MC-SSLm-PLUS-2.03
IPSec microcode : CNlite-MC-IPSECm-MAIN-2.06
Number of accelerators: 1
0: Int: Internal-Data0/0 : address is 4403.a7a2.e7c7, irq 11
1: Ext: Ethernet0/0 : address is 4403.a7a2.e7bf, irq 255
2: Ext: Ethernet0/1 : address is 4403.a7a2.e7c0, irq 255
3: Ext: Ethernet0/2 : address is 4403.a7a2.e7c1, irq 255
4: Ext: Ethernet0/3 : address is 4403.a7a2.e7c2, irq 255
5: Ext: Ethernet0/4 : address is 4403.a7a2.e7c3, irq 255
6: Ext: Ethernet0/5 : address is 4403.a7a2.e7c4, irq 255
7: Ext: Ethernet0/6 : address is 4403.a7a2.e7c5, irq 255
8: Ext: Ethernet0/7 : address is 4403.a7a2.e7c6, irq 255
9: Int: Internal-Data0/1 : address is 0000.0003.0002, irq 255
10: Int: Not used : irq 255
11: Int: Not used : irq 255
Licensed features for this platform:
Maximum Physical Interfaces : 8 perpetual
VLANs : 3 DMZ Restricted
Dual ISPs : Disabled perpetual
VLAN Trunk Ports : 0 perpetual
Inside Hosts : 50 perpetual
Failover : Disabled perpetual
VPN-DES : Enabled perpetual
VPN-3DES-AES : Enabled perpetual
AnyConnect Premium Peers : 2 perpetual
AnyConnect Essentials : Disabled perpetual
Other VPN Peers : 10 perpetual
Total VPN Peers : 12 perpetual
Shared License : Disabled perpetual
AnyConnect for Mobile : Disabled perpetual
AnyConnect for Cisco VPN Phone : Disabled perpetual
Advanced Endpoint Assessment : Disabled perpetual
UC Phone Proxy Sessions : 2 perpetual
Total UC Proxy Sessions : 2 perpetual
Botnet Traffic Filter : Disabled perpetual
Intercompany Media Engine : Disabled perpetual
This platform has a Base license.
Serial Number: JMX3434343T
Running Permanent Activation Key: 0x8509ef7f 0x2cff5895 0xa4675895 0x7989798 0xc1323132
Configuration register is 0x1
Configuration last modified by enable_15 at 16:21:28.863 UTC Wed Oct 23 2013
------------------ show disk0: controller ------------------
Flash Model: SMART CF
------------------ show clock ------------------
04:43:59.822 UTC Thu Oct 24 2013
------------------ show crashinfo ------------------
No crash file found.
------------------ show module ------------------
Mod Card Type Model Serial No.
0 ASA 5505 Adaptive Security Appliance ASA5505 JMX3434343T
Mod MAC Address Range Hw Version Fw Version Sw Version
0 1255.a3a4.e3bf to 1233.a4a4.e4c4 0.1 1.0(12)13 8.4(4)1
Mod SSC Application Name Status SSC Application Version
Mod Status Data Plane Status Compatibility
0 Up Sys Not Applicable
------------------ show memory ------------------
Free memory: 283382600 bytes (53%)
Used memory: 253488312 bytes (47%)
Total memory: 536870912 bytes (100%)
------------------ show conn count ------------------
76 in use, 704 most used
------------------ show xlate count ------------------
80 in use, 814 most used
------------------ show vpn-sessiondb summary ------------------
No sessions to display.
------------------ show blocks ------------------
SIZE MAX LOW CNT
0 400 399 400
4 100 99 99
80 347 332 347
256 200 192 195
1550 6374 6306 6371
2048 1200 1199 1200
2560 264 264 264
4096 100 99 100
8192 100 99 100
16384 100 99 100
65536 16 15 16
CORE LIMIT ALLOC HIGH CNT FAILED
0 24576 26 26 25 0
------------------ show blocks queue history detail ------------------
History buffer memory usage: 2832 bytes (default)
History analysis time limit: 100 msec
Please see 'show blocks exhaustion snapshot' for more information
------------------ show interface ------------------
Interface Ethernet0/0 "", is up, line protocol is up
Hardware is 88E6095, BW 100 Mbps, DLY 100 usec
Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps)
Input flow control is unsupported, output flow control is unsupported
Available but not configured via nameif
MAC address 4403.a7a2.e7bf, MTU not set
IP address unassigned
8257648 packets input, 9051289473 bytes, 0 no buffer
Received 0 broadcasts, 0 runts, 0 giants
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
0 pause input, 0 resume input
0 L2 decode drops
6222 switch ingress policy drops
6399241 packets output, 1011134108 bytes, 0 underruns
0 pause output, 0 resume output
0 output errors, 0 collisions, 0 interface resets
0 late collisions, 0 deferred
0 rate limit drops
0 switch egress policy drops
0 input reset drops, 0 output reset drops
Control Point Interface States:
Interface number is 3
Interface config status is active
Interface state is active
Interface Ethernet0/1 "", is up, line protocol is up
Hardware is 88E6095, BW 100 Mbps, DLY 100 usec
Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps)
Input flow control is unsupported, output flow control is unsupported
Available but not configured via nameif
MAC address 4403.a7a2.e7c0, MTU not set
IP address unassigned
1330699 packets input, 312264395 bytes, 0 no buffer
Received 63097 broadcasts, 0 runts, 0 giants
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
0 pause input, 0 resume input
0 L2 decode drops
0 switch ingress policy drops
1738131 packets output, 637935280 bytes, 0 underruns
0 pause output, 0 resume output
0 output errors, 0 collisions, 0 interface resets
0 late collisions, 0 deferred
0 rate limit drops
0 switch egress policy drops
0 input reset drops, 0 output reset drops
Control Point Interface States:
Interface number is 4
Interface config status is active
Interface state is active
Interface Ethernet0/2 "", is up, line protocol is up
Hardware is 88E6095, BW 100 Mbps, DLY 100 usec
Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps)
Input flow control is unsupported, output flow control is unsupported
Available but not configured via nameif
MAC address 4403.a7a2.e7c1, MTU not set
IP address unassigned
5028958 packets input, 693527818 bytes, 0 no buffer
Received 28835 broadcasts, 0 runts, 0 giants
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
0 pause input, 0 resume input
0 L2 decode drops
1 switch ingress policy drops
7782140 packets output, 8316018900 bytes, 0 underruns
0 pause output, 0 resume output
0 output errors, 0 collisions, 0 interface resets
0 late collisions, 0 deferred
0 rate limit drops
0 switch egress policy drops
0 input reset drops, 0 output reset drops
Control Point Interface States:
Interface number is 5
Interface config status is active
Interface state is active
Interface Ethernet0/3 "", is up, line protocol is up
Hardware is 88E6095, BW 100 Mbps, DLY 100 usec
Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps)
Input flow control is unsupported, output flow control is unsupported
Available but not configured via nameif
MAC address 4403.a7a2.e7c2, MTU not set
IP address unassigned
17048409 packets input, 21350059442 bytes, 0 no buffer
Received 75081 broadcasts, 0 runts, 0 giants
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
0 pause input, 0 resume input
0 L2 decode drops
18 switch ingress policy drops
8319277 packets output, 5138543287 bytes, 0 underruns
0 pause output, 0 resume output
0 output errors, 0 collisions, 0 interface resets
0 late collisions, 0 deferred
0 rate limit drops
0 switch egress policy drops
0 input reset drops, 0 output reset drops
Control Point Interface States:
Interface number is 6
Interface config status is active
Interface state is active
Interface Ethernet0/4 "", is down, line protocol is down
Hardware is 88E6095, BW 100 Mbps, DLY 100 usec
Auto-Duplex, Auto-Speed
Input flow control is unsupported, output flow control is unsupported
Available but not configured via nameif
MAC address 4403.a7a2.e7c3, MTU not set
IP address unassigned
0 packets input, 0 bytes, 0 no buffer
Received 0 broadcasts, 0 runts, 0 giants
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
0 pause input, 0 resume input
0 L2 decode drops
0 switch ingress policy drops
0 packets output, 0 bytes, 0 underruns
0 pause output, 0 resume output
0 output errors, 0 collisions, 0 interface resets
0 late collisions, 0 deferred
0 rate limit drops
0 switch egress policy drops
0 input reset drops, 0 output reset drops
Control Point Interface States:
Interface number is 7
Interface config status is not active
Interface state is active
Interface Ethernet0/5 "", is down, line protocol is down
Hardware is 88E6095, BW 100 Mbps, DLY 100 usec
Auto-Duplex, Auto-Speed
Input flow control is unsupported, output flow control is unsupported
Available but not configured via nameif
MAC address 4403.a7a2.e7c4, MTU not set
IP address unassigned
0 packets input, 0 bytes, 0 no buffer
Received 0 broadcasts, 0 runts, 0 giants
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
0 pause input, 0 resume input
0 L2 decode drops
0 switch ingress policy drops
0 packets output, 0 bytes, 0 underruns
0 pause output, 0 resume output
0 output errors, 0 collisions, 0 interface resets
0 late collisions, 0 deferred
0 rate limit drops
0 switch egress policy drops
0 input reset drops, 0 output reset drops
Control Point Interface States:
Interface number is 8
Interface config status is not active
Interface state is active
Interface Ethernet0/6 "", is down, line protocol is down
Hardware is 88E6095, BW 100 Mbps, DLY 100 usec
Auto-Duplex, Auto-Speed
Input flow control is unsupported, output flow control is unsupported
Available but not configured via nameif
MAC address 4403.a7a2.e7c5, MTU not set
IP address unassigned
0 packets input, 0 bytes, 0 no buffer
Received 0 broadcasts, 0 runts, 0 giants
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
0 pause input, 0 resume input
0 L2 decode drops
0 switch ingress policy drops
0 packets output, 0 bytes, 0 underruns
0 pause output, 0 resume output
0 output errors, 0 collisions, 0 interface resets
0 late collisions, 0 deferred
0 rate limit drops
0 switch egress policy drops
0 input reset drops, 0 output reset drops
Control Point Interface States:
Interface number is 9
Interface config status is not active
Interface state is active
Interface Ethernet0/7 "", is up, line protocol is up
Hardware is 88E6095, BW 100 Mbps, DLY 100 usec
Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps)
Input flow control is unsupported, output flow control is unsupported
Available but not configured via nameif
MAC address 4403.a7a2.e7c6, MTU not set
IP address unassigned
7293552 packets input, 4521902362 bytes, 0 no buffer
Received 6520 broadcasts, 0 runts, 0 giants
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
0 pause input, 0 resume input
0 L2 decode drops
0 switch ingress policy drops
16232858 packets output, 21234947011 bytes, 0 underruns
0 pause output, 0 resume output
0 output errors, 0 collisions, 0 interface resets
0 late collisions, 0 deferred
0 rate limit drops
0 switch egress policy drops
0 input reset drops, 0 output reset drops
Control Point Interface States:
Interface number is 10
Interface config status is active
Interface state is active
Interface Internal-Data0/0 "", is up, line protocol is up
Hardware is y88acs06, BW 1000 Mbps, DLY 10 usec
(Full-duplex), (1000 Mbps)
Input flow control is unsupported, output flow control is unsupported
MAC address 4403.a2a2.e2c2, MTU not set
IP address unassigned
15222257 packets input, 10134321711 bytes, 0 no buffer
Received 173531 broadcasts, 0 runts, 0 giants
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
0 pause input, 0 resume input
0 L2 decode drops, 0 demux drops
15128507 packets output, 10256870512 bytes, 0 underruns
0 pause output, 0 resume output
0 output errors, 0 collisions, 0 interface resets
0 late collisions, 0 deferred
0 input reset drops, 0 output reset drops, 0 tx hangs
input queue (blocks free curr/low): hardware (512/487)
output queue (blocks free curr/low): hardware (512/450)
Control Point Interface States:
Interface number is 2
Interface config status is active
Interface state is active
Interface Internal-Data0/1 "", is up, line protocol is up
Hardware is 88E6095, BW 1000 Mbps, DLY 10 usec
(Full-duplex), (1000 Mbps)
Input flow control is unsupported, output flow control is unsupported
MAC address 0000.0003.0002, MTU not set
IP address unassigned
15128465 packets input, 10256855882 bytes, 0 no buffer
Received 1967 broadcasts, 0 runts, 0 giants
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
0 pause input, 0 resume input
0 switch ingress policy drops
15222217 packets output, 10134318430 bytes, 0 underruns
0 pause output, 0 resume output
0 output errors, 0 collisions, 0 interface resets
0 late collisions, 0 deferred
0 switch egress policy drops
0 input reset drops, 0 output reset drops
Control Point Interface States:
Interface number is 11
Interface config status is active
Interface state is active
Interface Vlan1 "inside", is up, line protocol is up
Hardware is EtherSVI, BW 100 Mbps, DLY 100 usec
MAC address 4403.a7a2.e7c7, MTU 1500
IP address 192.168.1.1, subnet mask 255.255.255.0
Traffic Statistics for "inside":
4183727 packets input, 523675346 bytes
5702790 packets output, 5851485425 bytes
142576 packets dropped
1 minute input rate 22 pkts/sec, 2839 bytes/sec
1 minute output rate 30 pkts/sec, 22751 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 33 pkts/sec, 3746 bytes/sec
5 minute output rate 46 pkts/sec, 20906 bytes/sec
5 minute drop rate, 1 pkts/sec
Control Point Interface States:
Interface number is 14
Interface config status is active
Interface state is active
Interface Vlan2 "outside", is up, line protocol is up
Hardware is EtherSVI, BW 100 Mbps, DLY 100 usec
MAC address 4403.a7a2.e7c7, MTU 1492
IP address 98.22.77.33, subnet mask 255.255.255.255
Traffic Statistics for "outside":
10541983 packets input, 11433817622 bytes
3793777 packets output, 526586888 bytes
13654 packets dropped
1 minute input rate 47 pkts/sec, 41657 bytes/sec
1 minute output rate 18 pkts/sec, 2802 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 80 pkts/sec, 38519 bytes/sec
5 minute output rate 29 pkts/sec, 3749 bytes/sec
5 minute drop rate, 0 pkts/sec
Control Point Interface States:
Interface number is 15
Interface config status is active
Interface state is active
Interface Virtual0 "_internal_loopback", is up, line protocol is up
Hardware is Virtual MAC address 0000.0000.0000, MTU 1500
IP address 127.0.0.1, subnet mask 255.255.255.0
Traffic Statistics for "_internal_loopback":
1 packets input, 28 bytes
1 packets output, 28 bytes
1 packets dropped
1 minute input rate 0 pkts/sec, 0 bytes/sec
1 minute output rate 0 pkts/sec, 0 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 0 pkts/sec, 0 bytes/sec
5 minute output rate 0 pkts/sec, 0 bytes/sec
5 minute drop rate, 0 pkts/sec
Control Point Interface States:
Interface number is 12
Interface config status is active
Interface state is active
------------------ show cpu usage ------------------
CPU utilization for 5 seconds = 12%; 1 minute: 8%; 5 minutes: 8%
------------------ show cpu hogging process ------------------
Process: Unicorn Admin Handler, PROC_PC_TOTAL: 1, MAXHOG: 23, LASTHOG: 23
LASTHOG At: 06:01:57 UTC Oct 15 2013
PC: 0x0853e1f4 (suspend)
Process: Unicorn Admin Handler, NUMHOG: 1, MAXHOG: 23, LASTHOG: 23
LASTHOG At: 06:01:57 UTC Oct 15 2013
PC: 0x0853e1f4 (suspend)
Call stack: 0x0853e1f4 0x0853ec36 0x0854182c 0x0869cc4b 0x08415ae7 0x0840ae40 0x0806e6cf
0x08aade2b 0x0806e6cf 0x084a0a44 0x0849986d 0x08499aac 0x08499dd6 0x084a0909
Process: Unicorn Admin Handler, PROC_PC_TOTAL: 2, MAXHOG: 18, LASTHOG: 18
LASTHOG At: 06:01:57 UTC Oct 15 2013
PC: 0x0853fb48 (suspend)
Process: Unicorn Admin Handler, NUMHOG: 2, MAXHOG: 18, LASTHOG: 18
LASTHOG At: 06:01:57 UTC Oct 15 2013
PC: 0x0853fb48 (suspend)
Call stack: 0x0853fb48 0x0853fd1d 0x0853e1bc 0x0853ec36 0x0854182c 0x0869cc4b 0x08415ae7
0x0840ae40 0x0806e6cf 0x08aade2b 0x0806e6cf 0x084a0a44 0x0849986d 0x08499aac
Process: Unicorn Admin Handler, PROC_PC_TOTAL: 2, MAXHOG: 24, LASTHOG: 24
LASTHOG At: 06:01:57 UTC Oct 15 2013
PC: 0x084167d2 (suspend)
Process: Unicorn Admin Handler, NUMHOG: 2, MAXHOG: 24, LASTHOG: 24
LASTHOG At: 06:01:57 UTC Oct 15 2013
PC: 0x084167d2 (suspend)
Call stack: 0x08538afd 0x0853fa3a 0x0853fd1d 0x0853e1bc 0x0853ec36 0x0854182c 0x0869cc4b
0x08415ae7 0x0840ae40 0x0806e6cf 0x08aade2b 0x0806e6cf 0x084a0a44 0x0849986d
Process: Unicorn Admin Handler, PROC_PC_TOTAL: 1, MAXHOG: 12, LASTHOG: 12
LASTHOG At: 06:01:57 UTC Oct 15 2013
PC: 0x08ee9b4e (suspend)
Process: Unicorn Admin Handler, NUMHOG: 1, MAXHOG: 12, LASTHOG: 12
LASTHOG At: 06:01:57 UTC Oct 15 2013
PC: 0x08ee9b4e (suspend)
Call stack: 0x08ee9e12 0x084a1032 0x0849986d 0x08499aac 0x08499dd6 0x084a0909 0x080689bc
Process: Dispatch Unit, PROC_PC_TOTAL: 2, MAXHOG: 12, LASTHOG: 12
LASTHOG At: 06:01:57 UTC Oct 15 2013
PC: 0x081e208a (suspend)
Process: Dispatch Unit, NUMHOG: 2, MAXHOG: 12, LASTHOG: 12
LASTHOG At: 06:01:57 UTC Oct 15 2013
PC: 0x081e208a (suspend)
Call stack: 0x081e208a 0x080689bc
Process: Unicorn Admin Handler, NUMHOG: 1, MAXHOG: 180, LASTHOG: 180
LASTHOG At: 07:24:33 UTC Oct 19 2013
PC: 0x0806a8c2 (suspend)
Call stack: 0x0806a8c2 0x08a8ebd7 0x08a8f7c8 0x08a914fa 0x080ddd6f 0x080df9db 0x080f4132
0x080f5b16 0x080dd956 0x080de0ef 0x080de876 0x080dea37 0xdd6e6c1c 0xdd6e71b5
Process: rtcli async executor process, NUMHOG: 14, MAXHOG: 94, LASTHOG: 82
LASTHOG At: 07:28:06 UTC Oct 19 2013
PC: 0x08f262e3 (suspend)
Call stack: 0x0806a881 0x08f262e3 0x08f432a2 0x09064ba8 0x0903dfa9 0x0904f88d 0x0903ed70
0x09036221 0x0903d29b 0x0903d49f 0x09035ffa 0x09055321 0x0903dfa9 0x0904f88d
Process: rtcli async executor process, PROC_PC_TOTAL: 27, MAXHOG: 319, LASTHOG: 88
LASTHOG At: 07:28:06 UTC Oct 19 2013
PC: 0x08f4212d (suspend)
Process: rtcli async executor process, NUMHOG: 27, MAXHOG: 319, LASTHOG: 88
LASTHOG At: 07:28:06 UTC Oct 19 2013
PC: 0x08f4212d (suspend)
Call stack: 0x08069faa 0x08f4212d 0x08f260b6 0x08f27b85 0x08f27c35 0xcb147b98
Process: rtcli async executor process, PROC_PC_TOTAL: 12, MAXHOG: 45, LASTHOG: 10
LASTHOG At: 07:28:14 UTC Oct 19 2013
PC: 0x08f2594b (suspend)
Process: rtcli async executor process, NUMHOG: 12, MAXHOG: 45, LASTHOG: 10
LASTHOG At: 07:28:14 UTC Oct 19 2013
PC: 0x08f2594b (suspend)
Call stack: 0x0806a881 0x08f2594b 0x08f27b85 0x08f27c35 0xcb147b98
Process: Unicorn Admin Handler, NUMHOG: 4, MAXHOG: 11, LASTHOG: 11
LASTHOG At: 07:28:14 UTC Oct 19 2013
PC: 0x0806a8c2 (suspend)
Call stack: 0x0806a8c2 0x08a8ebd7 0x08b9aa46 0x08b9ad0e 0x080dc76f 0xdd6e6961 0xdd6e71b5
0xdd6e7b07 0xdd6e8d5c 0xdd6e138d 0xdd6e247a 0x080dcb22 0x0849f899 0x084981c7
Process: rtcli async executor process, PROC_PC_TOTAL: 83, MAXHOG: 298, LASTHOG: 119
LASTHOG At: 07:28:16 UTC Oct 19 2013
PC: 0x08f262e3 (suspend)
Process: rtcli async executor process, NUMHOG: 47, MAXHOG: 298, LASTHOG: 119
LASTHOG At: 07:28:16 UTC Oct 19 2013
PC: 0x08f262e3 (suspend)
Call stack: 0x0806a881 0x08f262e3 0x08f38fad 0x08f3acc0 0x0905a29e 0x0905b2ba 0x0903dfa9
0x0903ecb5 0x0904f6f5 0x0903ed70 0x09036221 0x0903d29b 0x0903d49f 0x09035ffa
Process: Unicorn Admin Handler, NUMHOG: 3, MAXHOG: 180, LASTHOG: 180
LASTHOG At: 07:28:16 UTC Oct 19 2013
PC: 0x0806a8c2 (suspend)
Call stack: 0x0806a881 0x0806a8c2 0x0816261b 0x095302a7 0x0954abef 0x0954acc3 0x0815aabe
0x08134da6 0x08c64632 0x08ea8079 0x08ea8481 0x08ea85f7 0x08f41adc 0x0806e6cf
Process: Unicorn Admin Handler, NUMHOG: 3, MAXHOG: 15, LASTHOG: 15
LASTHOG At: 07:28:20 UTC Oct 19 2013
PC: 0x0806a8c2 (suspend)
Call stack: 0x0806a881 0x0806a8c2 0x0947a399 0x0946d24d 0x0946d364 0x08c2b0e6 0x08c38f65
0x08ea810b 0x08ea8481 0x08ea85f7 0x08f41adc 0x0806e6cf 0x08f3cc48 0x092afca6
Process: Unicorn Admin Handler, NUMHOG: 3, MAXHOG: 64, LASTHOG: 64
LASTHOG At: 07:28:20 UTC Oct 19 2013
PC: 0x0806a8c2 (suspend)
Call stack: 0x0806a881 0x0806a8c2 0x0947a3e4 0x09479cf9 0x094750eb 0x08c3f645 0x08c3fcab
0x08c2b235 0x08c38f65 0x08ea810b 0x08ea8481 0x08ea85f7 0x08f41adc 0x0806e6cf
Process: IP Thread, NUMHOG: 4, MAXHOG: 14, LASTHOG: 14
LASTHOG At: 07:28:24 UTC Oct 19 2013
PC: 0x0806a8c2 (suspend)
Call stack: 0x0806a8c2 0x0947a399 0x0946d24d 0x0946d364 0x08c2b0e6 0x08c38f65 0x08ea810b
0x08ea8481 0x08ea85f7 0x08ea5f86 0x090e086e 0x090e0b6e 0x090b9a99 0x090b6b00
Process: Unicorn Admin Handler, PROC_PC_TOTAL: 22, MAXHOG: 180, LASTHOG: 64
LASTHOG At: 07:28:24 UTC Oct 19 2013
PC: 0x0806a8c2 (suspend)
Process: IP Thread, NUMHOG: 4, MAXHOG: 64, LASTHOG: 64
LASTHOG At: 07:28:24 UTC Oct 19 2013
PC: 0x0806a8c2 (suspend)
Call stack: 0x0806a8c2 0x0947a3e4 0x09479cf9 0x094750eb 0x08c3f645 0x08c3fcab 0x08c2b235
0x08c38f65 0x08ea810b 0x08ea8481 0x08ea85f7 0x08ea5f86 0x090e086e 0x090e0b6e
CPU hog threshold (msec): 10.240
Last cleared: None
------------------ show process ------------------
PC SP STATE Runtime SBASE Stack Process
Lwe 0x08058ba4 0xc82baf84 0x0a345788 0 0xc82b7078 15760/16384 block_diag
Mrd 0x081e1e11 0xc82ed54c 0x0a346144 430188 0xc82cd6e0 120548/131072 Dispatch Unit
Msi 0x087509a4 0xc82fdcb4 0x0a3458b0 713 0xc82f9da8 15688/16384 WebVPN KCD Process
Msi 0x09200c7b 0xc839b3d4 0x0a3458b0 3466 0xc83974c8 15688/16384 y88acs06 OneSec Thread
Mwe 0x080718dd 0xc83a3804 0x0a3458b0 0 0xc839f948 15808/16384 Reload Control Thread
Mwe 0x080849b9 0xc83ae79c 0x0a346e2c 0 0xc83aabe0 15256/16384 aaa
Mwe 0x08f4212d 0xc8d3d1e4 0x0a3458b0 9 0xc83aed78 15056/16384 UserFromCert Thread
Mwe 0x08f4212d 0xc9003fe4 0x0a3458b0 14 0xc83b2f50 14528/16384 aaa_shim_thread
Mwe 0x080b477c 0xc83bfa1c 0x0a347eb4 0 0xc83bbb20 15760/16384 CMGR Server Process
Mwe 0x080b6ded 0xc83c3b64 0x0a3458b0 0 0xc83bfcb8 15832/16384 CMGR Timer Process
Lwe 0x081e0474 0xc83d83bc 0x0a3568e0 0 0xc83d44b0 15488/16384 dbgtrace
Mwe 0x084de0ed 0xc83ef574 0x0a3458b0 0 0xc83e76d8 31680/32768 idfw_proc
Mwe 0x084ea35b 0xc83f75b4 0x0a3458b0 0 0xc83ef708 32216/32768 idfw_service
Mwe 0x084f5fc5 0xc83fb70c 0x0a3458b0 0 0xc83f78a0 15524/16384 idfw_adagent
Mwe 0x085351b5 0xc84038dc 0x0a3458b0 89 0xc83ffbd0 11568/16384 eswilp_svi_init
Mwe 0x08f4212d 0xc8770564 0x0a3458b0 0 0xc8433aa0 15280/16384 netfs_thread_init
Mwe 0x09576795 0xc844c10c 0x0a3458b0 0 0xc8448290 15848/16384 Chunk Manager
Msi 0x08ae10be 0xc84508ac 0x0a3458b0 3523 0xc844c9c0 15656/16384 PIX Garbage Collector
Mwe 0x08ac328a 0xc8461a0c 0x0a1d5d24 0 0xc845db00 16104/16384 IP Address Assign
Mwe 0x08d0477a 0xc85f7534 0x0a251838 0 0xc85f3628 16104/16384 QoS Support Module
Mwe 0x08b5c32a 0xc85fb70c 0x0a1d6c88 0 0xc85f7800 16104/16384 Client Update Task
Lwe 0x095d54f5 0xc860009c 0x0a3458b0 109750 0xc85fc1f0 14448/16384 Checkheaps
Mwe 0x08d093ed 0xc861080c 0x0a3458b0 454 0xc86089a0 19328/32768 Quack process
Mwe 0x08d8569d 0xc86189c4 0x0a3458b0 533 0xc8610b38 31952/32768 Session Manager
Mwe 0x08ed964d 0xc8620cd4 0xcadf5b08 8 0xc861ce68 15464/16384 uauth
Mwe 0x08e66621 0xc8624f0c 0x0a264a10 0 0xc8621000 15632/16384 Uauth_Proxy
Msp 0x08ea87de 0xc86313d4 0x0a3458b0 561 0xc862d4c8 15688/16384 SSL
Mwe 0x08ed72d4 0xc863554c 0x0a26bc14 0 0xc8631660 15708/16384 SMTP
Mwe 0x08ed170c 0xc86396a4 0x0a26af38 23255 0xc86357f8 13608/16384 Logger
Mwe 0x08ecfd1d 0xc863d80c 0x0a3458b0 0 0xc8639990 15784/16384 Syslog Retry Thread
Mwe 0x08ecadf5 0xc86419d4 0x0a3458b0 0 0xc863db28 15600/16384 Thread Logger
Mwe 0x08ed50b4 0xc866457c 0x0a26b5e0 0 0xc8660680 15464/16384 syslogd
Mwe 0x09132032 0xc8681094 0x0a2a5688 0 0xc867d1a8 15328/16384 vpnlb_thread
Mwe 0x092037ec 0xc86916c4 0x0a2aa9e8 0 0xc868d808 16024/16384 pci_nt_bridge
Mwe 0x082beb95 0xc8756e44 0x0a3458b0 0 0xc8752fb8 15864/16384 TLS Proxy Inspector
Msi 0x08da221c 0xc87d44a4 0x0a3458b0 2749 0xc87d0598 15688/16384 emweb/cifs_timer
Mwe 0x08852cc4 0xc88291f4 0x0a1c4c44 0 0xc88252f8 15712/16384 netfs_mount_handler
Msi 0x086b4248 0xc8316454 0x0a3458b0 27304 0xc8312568 15312/16384 arp_timer
Mwe 0x086bc58e 0xc8447fb4 0x0a371110 0 0xc84440f8 16024/16384 arp_forward_thread
Mwe 0x08eddb77 0xc8f2e27c 0x0a26c680 0 0xc8f2a380 15672/16384 tcp_fast
Mwe 0x08ee69a8 0xc8f3229c 0x0a26c680 0 0xc8f2e3b0 15656/16384 tcp_slow
Mwe 0x08f1df34 0xc8f42fac 0x0a2745d0 0 0xc8f3f0b0 16000/16384 udp_timer
Mwe 0x0814110d 0xc8fb133c 0xc83ca8d0 4 0xc8fad4a0 15664/16384 IPsec message handler
Mwe 0x087515c6 0xc8fdc834 0x0a376060 1 0xc8fd8958 16056/16384 Lic TMR
Mwe 0x087513bc 0xc8fe0884 0x0a1c0ea0 242 0xc8fdc988 16088/16384 Lic HA
Msi 0x08153267 0xc84270dc 0x0a3458b0 54986 0xc8423440 13872/16384 CTM message handler
Mwe 0x0811bd2d 0xc843bb8c 0x0a3458b0 0 0xc8437ce0 15832/16384 CTCP Timer process
Mwe 0x090d3d95 0xc843fbac 0x0a3458b0 0 0xc843bd10 15816/16384 L2TP data daemon
Mwe 0x090d6605 0xc9b5b24c 0x0a3458b0 0 0xc9b573b0 15816/16384 L2TP mgmt daemon
Mwe 0x090c2b27 0xc9b9339c 0x0a29a3ec 2228 0xc9b8f4e0 15480/16384 ppp_timer_thread
Msi 0x0913239d 0xc9b973ec 0x0a3458b0 4093 0xc9b93510 15640/16384 vpnlb_timer_thread
Mwe 0x081c7708 0xc9c67c84 0x0a13ef88 2899 0xc9c47f18 118548/131072 tmatch compile thread
Mwe 0x08d38b2d 0xcac940cc 0x0a3458b0 0 0xcac90210 15848/16384 ICMP event handler
Mwe 0x0908081d 0xcac98254 0x0a3458b0 0 0xcac943a8 15832/16384 Dynamic Filter VC Housekeeper
Mwe 0x08a1b612 0xcacc47f4 0x0a3458b0 819 0xcacc0938 13860/16384 IP Background
Mwe 0x08c26e63 0xcaed904c 0x0a3458b0 0 0xcaed51a0 15832/16384 Crypto CA
Mwe 0x08c60c18 0xcaedd1e4 0x0a3458b0 0 0xcaed9338 15896/16384 CERT API
Mwe 0x08c257d5 0xcaee6e24 0x0a3458b0 0 0xcaee2f58 15928/16384 Crypto PKI RECV
Mwe 0x0878dd85 0xc862d1cc 0x0a3458b0 187 0xc8629330 15272/16384 ESW_MRVL switch interrupt service
Mwe 0x08cae62c 0xc866c89c 0x0a1ea7e0 0 0xc86689b0 15832/16384 lina_int
Mrd 0x0959948b 0xc8684f1c 0x0a346144 28493079 0xc8681340 13824/16384 esw_stats
Lsi 0x08af3199 0xc86958bc 0x0a3458b0 152 0xc86919a0 15704/16384 uauth_urlb clean
Lwe 0x08acbd76 0xc83ff8b4 0x0a3458b0 4432 0xc83fba38 14308/16384 pm_timer_thread
Mwe 0x08555f8d 0xc8418b0c 0x0a3458b0 0 0xc8414c60 15832/16384 IKE Common thread
Mwe 0x0858cecd 0xcaf8688c 0x0a3458b0 0 0xcaf82a60 15704/16384 IKE Timekeeper
Mwe 0x0857bad1 0xcaf8ccc4 0x0a1bc678 1 0xcaf890e8 12116/16384 IKE Daemon
Mwe 0x08629eb3 0xcaf90c64 0x0a3458b0 964 0xcaf8d118 14744/16384 IKEv2 Daemon
Mwe 0x08628e7c 0xcaf94ff4 0x0a3458b0 1095 0xcaf91148 15640/16384 IKEv2 DPD Client Process
Mwe 0x08e7d2e4 0xcafafd7c 0x0a2690f4 0 0xcafabe90 16072/16384 RADIUS Proxy Event Daemon
Mwe 0x08e41f35 0xcafb3d74 0xcb07e358 7 0xcafb0028 14912/16384 RADIUS Proxy Listener
Mwe 0x08e7ca0d 0xcafb806c 0x0a3458b0 0 0xcafb41c0 15832/16384 RADIUS Proxy Time Keeper
Mwe 0x086a1e44 0xcafbc184 0x0a3710c8 0 0xcafb8358 15264/16384 Integrity FW Task
Mrd 0x082c923a 0xcaffce54 0x0a346144 0 0xcaff8f98 14552/16384 CP Threat-Detection Processing
Mwe 0x081fb74e 0xcb0cc4bc 0x09c4a8bc 2497 0xcb0acd60 122448/131072 ci/console
Msi 0x08b0ea8c 0xcb0d0e14 0x0a3458b0 217583 0xcb0ccef8 14004/16384 update_cpu_usage
Mwe 0x08ef5ff5 0xcb0d4ecc 0x0a3458b0 77 0xcb0d1090 15360/16384 npshim_thread
Msi 0x08b0eb14 0xcb0e1224 0x0a3458b0 0 0xcb0dd428 13104/16384 NIC status poll
Mwe 0x08dd5f2c 0xcb0e54bc 0x0a259ec8 228 0xcb0e15c0 15540/16384 SNMP Notify Thread
Mwe 0x086aba0e 0xcb12ebe4 0x0a37170c 235813 0xcb126d08 25428/32768 IP Thread
Mwe 0x086b31fe 0xcb132d9c 0x0a371100 9150 0xcb12eea0 9700/16384 ARP Thread
Mwe 0x084be3ae 0xcb136f8c 0x0a3716c8 1743 0xcb1331b0 12696/16384 icmp_thread
Mwe 0x08f1f443 0xcb13b1e4 0x0a3458b0 158 0xcb137348 15728/16384 udp_thread
Mwe 0x08ee0f44 0xcb13f0bc 0x0a37178c 0 0xcb13b4e0 15288/16384 tcp_thread
Mwe 0x08f4212d 0xcb1bccd4 0x0a3458b0 12848 0xcb13fd70 26600/32768 rtcli async executor process
Mwe 0x090e408d 0xcb4dff64 0x0a3458b0 0 0xcb4dc0a8 14608/16384 PPPOE background daemon
Mwe 0x090e53c4 0xcb4e3fb4 0x0a29aa4c 1 0xcb4e00d8 14656/16384 PPPOE CLI daemon
Mwe 0x0824ff45 0xcb501e4c 0x0a3458b0 258 0xcb4fdf90 15624/16384 Timekeeper
Mwe 0x08e41f35 0xcb89a6d4 0xcb89eb10 7 0xcb896998 15392/16384 EAPoUDP-sock
Mwe 0x0822323d 0xcb89e544 0x0a3458b0 0 0xcb89a9c8 15016/16384 EAPoUDP
Mwe 0x08204371 0xcb3df9dc 0x0a3458b0 149 0xcb3dbb20 15168/16384 DHCPD Timer
Mwe 0x082066a1 0xcb3e6404 0x0a3458b0 1286 0xcb3e25a8 7172/16384 dhcp_daemon
Mwe 0x0910dfd4 0xcbc3b4e4 0x0a2a5380 0 0xcbc335e8 32472/32768 vpnfol_thread_msg
Msi 0x09116252 0xcbc3fac4 0x0a3458b0 2657 0xcbc3bbd8 15656/16384 vpnfol_thread_timer
Mwe 0x09114882 0xcbc44074 0x0a2a53c0 0 0xcbc401c8 16008/16384 vpnfol_thread_sync
Msi 0x09115fdc 0xcbc486b4 0x0a3458b0 11061 0xcbc447b8 15672/16384 vpnfol_thread_unsent
Mwe 0x0869e365 0xc8689384 0x0a3458b0 0 0xc86854d8 15832/16384 Integrity Fw Timer Thread
Msi 0x08852fd6 0xc868d55c 0x0a3458b0 206 0xc8689670 15656/16384 netfs_vnode_reclaim
Mwe 0x08f4212d 0xcb2a1914 0x0a3458b0 1277 0xcbd38510 15008/16384 Unicorn Proxy Thread
Mwe 0x0825afcb 0xcbc61254 0x0a3458b0 335 0xcbc5d788 14272/16384 emweb/https
Mwe 0x08eef828 0xcbd4dd0c 0xcbd4fd7c 0 0xcbd49fd0 14888/16384 listen/telnet
Mwe 0x08aac530 0xcbdbd754 0xcbd6c9fc 102 0xcbd9def8 127432/131072 Unicorn Admin Handler
Mwe 0x08aab345 0xcbddd644 0x0a3458b0 105 0xcbdbdf28 123712/131072 Unicorn Admin Handler
Mwe 0x08cd7c6f 0xcaf358cc 0x0a49edc8 0 0xcaf31bb0 15384/16384 qos_metric_daemon
Mwe 0x08218c82 0xcb2693fc 0x0a3458b0 3 0xcb265560 13248/16384 DHCP Client
Mwe 0x08f1d929 0xcb4bb0fc 0xc8f3ece4 0 0xcb4b3300 31552/32768 DHCPC Receiver
M* 0x08a86f55 0xdcc1df2c 0x0a346144 274 0xcb34deb8 19696/32768 telnet/ci
- - - - 0 - - DATAPATH-0-455
- - - - 744377118 - - scheduler
- - - - 774156778 - - total elapsed
------------------ show kernel process ------------------
PID PPID PRI NI VSIZE RSS WCHAN STAT RUNTIME COMMAND
1 0 20 0 2080768 616 3725686580 S 630 init
2 0 15 -5 0 0 3725738556 S 0 kthreadd
3 2 15 -5 0 0 3725692956 S 0 ksoftirqd/0
4 2 15 -5 0 0 3725728656 S 0 events/0
5 2 15 -5 0 0 3725728656 S 0 khelper
50 2 15 -5 0 0 3725728656 S 0 kblockd/0
53 2 15 -5 0 0 3726777703 S 0 kseriod
99 2 20 0 0 0 3725848262 S 0 pdflush
100 2 20 0 0 0 3725848262 S 0 pdflush
101 2 15 -5 0 0 3725861131 S 0 kswapd0
102 2 15 -5 0 0 3725728656 S 0 aio/0
103 2 15 -5 0 0 3725728656 S 0 nfsiod
214 2 15 -5 0 0 3725728656 S 0 hid_compat
215 2 15 -5 0 0 3725728656 S 0 rpciod/0
240 1 16 -4 1789952 600 3725997327 S 4 udevd
272 240 18 -2 1785856 564 3725997327 S 0 udevd
277 240 18 -2 1785856 552 3725997327 S 0 udevd
421 1 20 0 5201920 1600 4294967295 S 11 lwsmd
423 421 20 0 16736256 3600 4294967295 S 102 lwregd
448 1 20 0 2084864 512 3725686580 S 1 sh
449 448 20 0 10186752 528 4294967295 S 2 lina_monitor
451 449 0 -20 440270848 53000 4294967295 S 77713055 lina
------------------ show kernel cgroup-controller detail ------------------
memory controller:
memory.limit_in_bytes: unlimited
memory.usage_in_bytes: 61665280 (11%)
memory.max_usage_in_bytes: 64245760 (12%)
memory.failcnt: 0
tasks:
group "normal"
memory.limit_in_bytes: unlimited
memory.usage_in_bytes: 77824 (0%)
memory.max_usage_in_bytes: 544768 (0%)
memory.failcnt: 0
tasks:
PID RSS COMMAND
1 630784 init
2 0 kthreadd
3 0 ksoftirqd/0
4 0 events/0
5 0 khelper
50 0 kblockd/0
53 0 kseriod
99 0 pdflush
100 0 pdflush
101 0 kswapd0
102 0 aio/0
103 0 nfsiod
214 0 hid_compat
215 0 rpciod/0
240 614400 udevd
272 577536 udevd
277 565248 udevd
448 524288 sh
group "privileged"
memory.limit_in_bytes: unlimited
memory.usage_in_bytes: 22327296 (4%)
memory.max_usage_in_bytes: 22515712 (4%)
memory.failcnt: 0
tasks:
PID RSS COMMAND
449 540672 lina_monitor
450 0 lina_monitor
451 54280192 lina
452 0 lina
453 0 lina
454 0 lina
455 0 lina
group "restricted"
memory.limit_in_bytes: 23068672 (4%)
memory.usage_in_bytes: 1724416 (0%)
memory.max_usage_in_bytes: 1900544 (0%)
memory.failcnt: 0
tasks:
PID RSS COMMAND
421 1638400 lwsmd
422 0 lwsmd
423 3686400 lwregd
425 0 lwregd
426 0 lwregd
427 0 lwregd
428 0 lwregd
429 0 lwregd
430 0 lwsmd
431 0 lwsmd
432 0 lwsmd
433 0 lwsmd
434 0 lwsmd
cpu controller:
cpu.shares: 1024
cpuacct.usage: 777015353084076
tasks:
group "normal"
cpu.shares: 1024
cpuacct.usage: 53525955783 (0%)
tasks:
PID RSS COMMAND
1 630784 init
2 0 kthreadd
3 0 ksoftirqd/0
4 0 events/0
5 0 khelper
50 0 kblockd/0
53 0 kseriod
99 0 pdflush
100 0 pdflush
101 0 kswapd0
102 0 aio/0
103 0 nfsiod
214 0 hid_compat
215 0 rpciod/0
240 614400 udevd
272 577536 udevd
277 565248 udevd
448 524288 sh
449 540672 lina_monitor
450 0 lina_monitor
451 54280192 lina
452 0 lina
453 0 lina
454 0 lina
group "privileged"
cpu.shares: 16384
cpuacct.usage: 776952528547140 (100%)
tasks:
PID RSS COMMAND
455 0 lina
group "restricted"
cpu.shares: 1024
cpuacct.usage: 1291957168 (0%)
tasks:
PID RSS COMMAND
421 1638400 lwsmd
422 0 lwsmd
423 3686400 lwregd
425 0 lwregd
426 0 lwregd
427 0 lwregd
428 0 lwregd
429 0 lwregd
430 0 lwsmd
431 0 lwsmd
432 0 lwsmd
433 0 lwsmd
434 0 lwsmd
------------------ show traffic ------------------
inside:
received (in 422169.300 secs):
4183910 packets 523687951 bytes
9 pkts/sec 1006 bytes/sec
transmitted (in 422169.300 secs):
5702974 packets 5851550584 bytes
3 pkts/sec 13006 bytes/sec
1 minute input rate 22 pkts/sec, 2839 bytes/sec
1 minute output rate 30 pkts/sec, 22751 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 33 pkts/sec, 3746 bytes/sec
5 minute output rate 46 pkts/sec, 20906 bytes/sec
5 minute drop rate, 1 pkts/sec
outside:
received (in 422169.300 secs):
10542135 packets 11433861540 bytes
4 pkts/sec 27002 bytes/sec
transmitted (in 422169.300 secs):
3793870 packets 526596330 bytes
8 pkts/sec 1003 bytes/sec
1 minute input rate 47 pkts/sec, 41657 bytes/sec
1 minute output rate 18 pkts/sec, 2802 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 80 pkts/sec, 38519 bytes/sec
5 minute output rate 29 pkts/sec, 3749 bytes/sec
5 minute drop rate, 0 pkts/sec
_internal_loopback:
received (in 422168.950 secs):
0 packets 0 bytes
0 pkts/sec 0 bytes/sec
transmitted (in 422168.950 secs):
0 packets 0 bytes
0 pkts/sec 0 bytes/sec
1 minute input rate 0 pkts/sec, 0 bytes/sec
1 minute output rate 0 pkts/sec, 0 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 0 pkts/sec, 0 bytes/sec
5 minute output rate 0 pkts/sec, 0 bytes/sec
5 minute drop rate, 0 pkts/sec
Aggregated Traffic on Physical Interface
Ethernet0/0:
received (in 776992.730 secs):
8257731 packets 9051312645 bytes
5 pkts/sec 11002 bytes/sec
transmitted (in 776992.730 secs):
6399342 packets 1011145708 bytes
2 pkts/sec 1002 bytes/sec
1 minute input rate 26 pkts/sec, 24481 bytes/sec
1 minute output rate 20 pkts/sec, 3472 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 40 pkts/sec, 20147 bytes/sec
5 minute output rate 29 pkts/sec, 4280 bytes/sec
5 minute drop rate, 0 pkts/sec
Ethernet0/1:
received (in 776992.730 secs):
1330771 packets 312271947 bytes
1 pkts/sec 3 bytes/sec
transmitted (in 776992.730 secs):
1738316 packets 638003030 bytes
2 pkts/sec 3 bytes/sec
1 minute input rate 4 pkts/sec, 405 bytes/sec
1 minute output rate 11 pkts/sec, 3333 bytes/sec
<--- More --->
1 minute drop rate, 0 pkts/sec
5 minute input rate 7 pkts/sec, 735 bytes/sec
5 minute output rate 13 pkts/sec, 4410 bytes/sec
5 minute drop rate, 0 pkts/sec
Ethernet0/2:
received (in 776993.220 secs):
5028958 packets 693527818 bytes
0 pkts/sec 2 bytes/sec
transmitted (in 776993.220 secs):
7782202 packets 8316039741 bytes
4 pkts/sec 10000 bytes/sec
1 minute input rate 1 pkts/sec, 153 bytes/sec
1 minute output rate 2 pkts/sec, 391 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 1 pkts/sec, 187 bytes/sec
5 minute output rate 3 pkts/sec, 1011 bytes/sec
5 minute drop rate, 0 pkts/sec
Ethernet0/3:
received (in 776993.220 secs):
17219822 packets 21609826615 bytes
0 pkts/sec 27005 bytes/sec
transmitted (in 776993.220 secs):
8373382 packets 5142266559 bytes
5 pkts/sec 6004 bytes/sec
<--- More --->
1 minute input rate 8384 pkts/sec, 12695156 bytes/sec
1 minute output rate 2657 pkts/sec, 203156 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 8010 pkts/sec, 12112337 bytes/sec
5 minute output rate 2525 pkts/sec, 188122 bytes/sec
5 minute drop rate, 0 pkts/sec
Ethernet0/4:
received (in 776993.680 secs):
0 packets 0 bytes
0 pkts/sec 0 bytes/sec
transmitted (in 776993.680 secs):
0 packets 0 bytes
0 pkts/sec 0 bytes/sec
1 minute input rate 0 pkts/sec, 0 bytes/sec
1 minute output rate 0 pkts/sec, 0 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 0 pkts/sec, 0 bytes/sec
5 minute output rate 0 pkts/sec, 0 bytes/sec
5 minute drop rate, 0 pkts/sec
Ethernet0/5:
received (in 776993.690 secs):
0 packets 0 bytes
0 pkts/sec 0 bytes/sec
transmitted (in 776993.690 secs):
<--- More --->
0 packets 0 bytes
0 pkts/sec 0 bytes/sec
1 minute input rate 0 pkts/sec, 0 bytes/sec
1 minute output rate 0 pkts/sec, 0 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 0 pkts/sec, 0 bytes/sec
5 minute output rate 0 pkts/sec, 0 bytes/sec
5 minute drop rate, 0 pkts/sec
Ethernet0/6:
received (in 776994.140 secs):
0 packets 0 bytes
0 pkts/sec 0 bytes/sec
transmitted (in 776994.140 secs):
0 packets 0 bytes
0 pkts/sec 0 bytes/sec
1 minute input rate 0 pkts/sec, 0 bytes/sec
1 minute output rate 0 pkts/sec, 0 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 0 pkts/sec, 0 bytes/sec
5 minute output rate 0 pkts/sec, 0 bytes/sec
5 minute drop rate, 0 pkts/sec
Ethernet0/7:
received (in 776994.140 secs):
7328915 packets 4524298170 bytes
<--- More --->
3 pkts/sec 5004 bytes/sec
transmitted (in 776994.140 secs):
16345245 packets 21405489647 bytes
4 pkts/sec 27001 bytes/sec
1 minute input rate 2330 pkts/sec, 158045 bytes/sec
1 minute output rate 7422 pkts/sec, 11264540 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 2481 pkts/sec, 168427 bytes/sec
5 minute output rate 7977 pkts/sec, 12105867 bytes/sec
5 minute drop rate, 0 pkts/sec
Internal-Data0/0:
received (in 776994.640 secs):
15222548 packets 10134365294 bytes
3 pkts/sec 13004 bytes/sec
transmitted (in 776994.640 secs):
15128813 packets 10256961010 bytes
2 pkts/sec 13001 bytes/sec
1 minute input rate 45 pkts/sec, 24860 bytes/sec
1 minute output rate 49 pkts/sec, 26647 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 73 pkts/sec, 24918 bytes/sec
5 minute output rate 75 pkts/sec, 26334 bytes/sec
5 minute drop rate, 0 pkts/sec
Internal-Data0/1:
<--- More --->
received (in 776994.640 secs):
15128721 packets 10256943282 bytes
2 pkts/sec 13001 bytes/sec
transmitted (in 776994.640 secs):
15222455 packets 10134357062 bytes
3 pkts/sec 13004 bytes/sec
1 minute input rate 48 pkts/sec, 26530 bytes/sec
1 minute output rate 45 pkts/sec, 24826 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 75 pkts/sec, 26323 bytes/sec
5 minute output rate 73 pkts/sec, 24908 bytes/sec
5 minute drop rate, 0 pkts/sec
------------------ show perfmon ------------------
PERFMON STATS: Current Average
Xlates 0/s 0/s
Connections 0/s 0/s
TCP Conns 0/s 0/s
UDP Conns 0/s 0/s
URL Access 0/s 0/s
URL Server Req -
VPN stops forwarding traffic on subsequent connections (Cisco 861)
Hello everyone,
I have a very strange problem on 2 (independent) Cisco 861 routers in different places.
They are both configured as easyVPN servers. One uses UDP, the other TCP. VPN clients connect by using Cisco VPN client software. This cannot be changed because the customer expects it this way. Both routers have the same problem:
* the first VPN connection after a reset works fine. Traffic passes through and it is perfectly usable. I can ping the internal network interface on the router side from the client without problems.
* the second connection (and all subsequent ones from different client machines etc.) connects fine, no errors on the client whatsoever (not sure I evaluated all possible debug output on the "server" side). However, no traffic passes through. Pings do not come back from the 861 anymore through the VPN tunnel.
I already enabled ICMP debugging and saw that pings are actually answered by the 861, but do not reach the client.The same seems to happen to any and all other packets as well.
* If I restart the 861 the very same thing happens: first VPN connection works fine. You disconnect, try another connection from the very same client computer, and it does not work anymore until the next router reset.
I append the configuration for sake of completeness. confidential parts are represented by XXX. Some ACLs are not in use right now; I used them for testing.
Quite frankly, I am out of ideas (and desperate).
Any ideas?
Best Regards
Mike
version 15.0
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
hostname XXX
boot-start-marker
boot-end-marker
logging buffered 51200
logging console critical
enable secret 5 XXX
enable password 7 XXX
aaa new-model
aaa authentication login default local
aaa authentication login ciscocp_vpn_xauth_ml_1 local
aaa authorization exec default local
aaa authorization network ciscocp_vpn_group_ml_1 local
aaa session-id common
memory-size iomem 10
clock timezone Berlin 1
crypto pki trustpoint TP-self-signed-2638506017
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-2638506017
revocation-check none
rsakeypair TP-self-signed-2638506017
no ip source-route
ip cef
no ip bootp server
ip domain name local
license udi pid CISCO861-K9 sn XXX
archive
log config
hidekeys
no spanning-tree vlan 1
username root privilege 15 secret 5 XXX
username remote secret 5 XXX
crypto ctcp port 10000
ip tcp synwait-time 10
ip ssh time-out 60
ip ssh authentication-retries 2
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp nat keepalive 20
crypto isakmp client configuration group vpn
key XXX
pool SDM_POOL_1
acl 104
netmask 255.255.255.0
crypto isakmp profile ciscocp-ike-profile-1
match identity group vpn
client authentication list ciscocp_vpn_xauth_ml_1
isakmp authorization list ciscocp_vpn_group_ml_1
client configuration address respond
client configuration group vpn
virtual-template 1
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec profile CiscoCP_Profile1
set transform-set ESP-3DES-SHA
set isakmp-profile ciscocp-ike-profile-1
interface Loopback0
ip address 192.168.234.1 255.255.255.0
interface FastEthernet0
interface FastEthernet1
interface FastEthernet2
interface FastEthernet3
interface FastEthernet4
ip address dhcp
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
duplex auto
speed auto
interface Virtual-Template1 type tunnel
ip unnumbered Loopback0
tunnel mode ipsec ipv4
tunnel protection ipsec profile CiscoCP_Profile1
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$
ip address 192.168.233.1 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
ip virtual-reassembly
ip tcp adjust-mss 1452
ip local pool SDM_POOL_1 192.168.234.2 192.168.234.127
ip forward-protocol nd
no ip http server
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip route 10.179.232.0 255.255.255.0 192.168.233.2
ip route 172.16.0.0 255.255.0.0 192.168.233.2
ip access-list log-update threshold 10
logging trap debugging
access-list 1 remark INSIDE_IF=Vlan1
access-list 1 remark CCP_ACL Category=2
access-list 1 permit 192.168.233.0 0.0.0.255
access-list 100 remark XXX
access-list 100 permit ip 192.168.233.0 0.0.0.255 any
access-list 100 permit ip 192.168.234.0 0.0.0.255 any
access-list 101 remark CCP_ACL Category=4
access-list 101 permit ip 192.168.233.0 0.0.0.255 any
access-list 101 permit ip 192.168.234.0 0.0.0.255 any
access-list 102 permit ip 192.168.233.0 0.0.0.255 192.168.234.0 0.0.0.255
access-list 103 permit ip 192.168.233.0 0.0.0.255 192.168.234.0 0.0.0.255 log
access-list 103 permit ip 192.168.234.0 0.0.0.255 192.168.233.0 0.0.0.255 log
access-list 104 permit ip 192.168.233.0 0.0.0.255 any log-input
access-list 104 permit ip 192.168.234.0 0.0.0.255 any log-input
no cdp run
control-plane
banner exec ^CCC
XXX
^C
banner login ^CCC
XXX
^C
line con 0
no modem enable
transport output telnet
line aux 0
transport output telnet
line vty 0 4
privilege level 15
transport input ssh
scheduler max-task-time 5000
scheduler allocate 4000 1000
scheduler interval 500
endHi,
I addded a dynamic crypto map to the configuration according to the document you sent. However, it does not work yet.
There must be some stupid mistake or mixup with the old config.
The router logs:
000038: *Mar 1 01:19:24.047 Berlin: %CRYPTO-6-IKMP_MODE_FAILURE: Processing of Aggressive mode failed with peer at XXX
000039: *Mar 1 01:19:29.403 Berlin: CTCP: cTCP connection entry not found. Dropping the packet
Correspondingly, the client retransmits a few times during a connection attempt and then fails.
The current configuration is:
version 15.0
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
hostname XXX
boot-start-marker
boot-end-marker
logging buffered 51200
logging console critical
enable secret XXX
enable password XXX
aaa new-model
aaa authentication login default local
aaa authentication login ciscocp_vpn_xauth_ml_1 local
aaa authorization exec default local
aaa authorization network ciscocp_vpn_group_ml_1 local
aaa session-id common
memory-size iomem 10
clock timezone Berlin 1
crypto pki trustpoint TP-self-signed-2638506017
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-2638506017
revocation-check none
rsakeypair TP-self-signed-2638506017
no ip source-route
no ip cef
no ip bootp server
ip domain name local
license udi pid CISCO861-K9 sn XXX
archive
log config
hidekeys
no spanning-tree vlan 1
username root privilege 15 secret 5 XXX
username remote secret 5 XXX
crypto ctcp keepalive 10
crypto ctcp port 10000
ip tcp synwait-time 10
ip ssh time-out 60
ip ssh authentication-retries 2
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp nat keepalive 20
crypto isakmp client configuration group vpn
key XXX
pool SDM_POOL_1
acl 105
netmask 255.255.255.0
crypto isakmp client configuration group testgroup
key XXX
pool SDM_POOL_1
crypto isakmp profile ciscocp-ike-profile-1
match identity group vpn
client authentication list ciscocp_vpn_xauth_ml_1
isakmp authorization list ciscocp_vpn_group_ml_1
client configuration address respond
client configuration group vpn
crypto isakmp profile VPNclient
description VPN clients profile
match identity group testgroup
client authentication list clientauth
isakmp authorization list groupauthor
client configuration address respond
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec profile CiscoCP_Profile1
set transform-set ESP-3DES-SHA
set isakmp-profile ciscocp-ike-profile-1
crypto dynamic-map dynmap 5
set transform-set ESP-3DES-SHA
set isakmp-profile VPNclient
crypto map mymap 10 ipsec-isakmp dynamic dynmap
interface Loopback0
ip address 192.168.234.1 255.255.255.0
interface FastEthernet0
interface FastEthernet1
interface FastEthernet2
interface FastEthernet3
interface FastEthernet4
mtu 1300
ip address dhcp
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
duplex auto
speed auto
interface Virtual-Template1 type tunnel
ip unnumbered Loopback0
tunnel mode ipsec ipv4
crypto map mymap
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$
ip address 192.168.233.1 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
ip virtual-reassembly
ip tcp adjust-mss 1452
ip local pool SDM_POOL_1 192.168.234.2 192.168.234.127
ip forward-protocol nd
no ip http server
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip route 10.179.232.0 255.255.255.0 192.168.233.2
ip route 172.16.0.0 255.255.0.0 192.168.233.2
ip access-list log-update threshold 10
logging trap debugging
access-list 1 remark INSIDE_IF=Vlan1
access-list 1 remark CCP_ACL Category=2
access-list 1 permit 192.168.233.0 0.0.0.255
access-list 100 remark XXX
access-list 100 permit ip 192.168.233.0 0.0.0.255 any
access-list 100 permit ip 192.168.234.0 0.0.0.255 any
access-list 101 remark CCP_ACL Category=4
access-list 101 permit ip 192.168.233.0 0.0.0.255 any
access-list 101 permit ip 192.168.234.0 0.0.0.255 any
access-list 102 permit ip 192.168.233.0 0.0.0.255 192.168.234.0 0.0.0.255
access-list 103 permit ip 192.168.233.0 0.0.0.255 192.168.234.0 0.0.0.255 log
access-list 103 permit ip 192.168.234.0 0.0.0.255 192.168.233.0 0.0.0.255 log
access-list 104 permit ip 192.168.233.0 0.0.0.255 any log-input
access-list 104 permit ip 192.168.234.0 0.0.0.255 any log-input
access-list 105 permit ip 192.168.233.0 0.0.0.255 192.168.234.0 0.0.0.255
no cdp run
control-plane
banner exec ^CCC
XXX
^C
banner login ^CCC
XXX
^C
line con 0
no modem enable
transport output telnet
line aux 0
transport output telnet
line vty 0 4
privilege level 15
transport input ssh
scheduler max-task-time 5000
scheduler allocate 4000 1000
scheduler interval 500
end -
ASA /Router -SNMP Trap when IP SLA monitored (ICMP timeout)
Hi,
I am looking for some solution for my below requirment
Requirment is :
How do I configure ASA or Router to send SNMP Trap when IP SLA monitored features enabled (ICMP request or 900 millisecond delay from destination IP)
Thanks in advance..Hi,
Maybe this thread might help you?
https://supportforums.cisco.com/thread/2039293
I have not personally configured these type of SLA configurations on an ASA other than for testing purposes. We handle Dual ISP setups outside the ASA firewalls.
- Jouni -
ICMP Inspection and Extended Access-List
I need a little help clarifying the need for an Extended Access-list when ICMP Inspect is enabled on an ASA. From reading various documents such as the following (http://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/15246-31.html), I CAN allow ICMP through my ASA using an extended access-list or enabling ICMP Inspection in the Modular Policy Framework. Is that true? I only NEED an Extended Access-list or enable ICMP Inspection? I do not need both? Or is it best practice to do both?
What does the ASA do to a PING from a host on the inside interface (Security 100) to host on the outside interface (Security 0) when ICMP Inspection is enabled with the following commands:
policy-map global_policy
class inspection_default
inspect_icmp
However, the following commands are NOT placed on the inbound Extended Access-list of the outside interface:
access-list inbound permit icmp any any echo-reply
access-list inbound permit icmp any any source-quench
access-list inbound permit icmp any any unreachable
access-list inbound permit icmp any any time-exceeded
access-group inbound in interface outside
Will the PING complete?
Thank you,
T.J.Hi, T.J.
If problem is still actual, I can answer you this question.
Let's see situation without ICMP inspection enabled:
The Cisco ASA will allow ICMP packets only in case if ACL entry exist on interface, where packet goes in. If we're speaking about ping, then ACL rules must allow packets in both directions.
In case with ICMP inspection, with ACL entry you should allow only request packets, replies will be allowed based on ICMP inspection created connection.
Speaking about your particular example with different security levels - with default ACL rule, that allow traffic from higher interface to lower - NO, you can do not enter that rules you described, and as you'll have successful ping.
If you deleted this rule and administrate allowed traffic manually, then YES, you must allow ICMP requests to have successful ping.
P.S. It's not a good practice to leave that default rule, which allow traffic from higher sec.lvl. to lower.
Maybe you are looking for
-
I have iTunes on an old pc and am thinking of buying a MacBook Air. I am wondering how to get the content of my iPad on to the Mac as I know that sync only happens in one direction, from pc to device. I assume therefore that when I attach my pad to t
-
SOAP Certificate issue...High priority...please check
We are getting the below error in SOAP receiver side and 2 day ago certificates got expired and we imported new certificates when we trigger an idoc in receiver side SOAP is showing the below error.in receiver communication channel monitoring. SOAP:
-
COOIS Capacity report for Collective Order
Hello Expert, Need your help & assistance. I have an issue related to collective order, COOIS report display for list Capacity. For one collective order, when I check this COOIS>Capacity report it display only header order detail, not for dependent o
-
During login, document icons display as the familiar icon we've become accustomed to, but when login completes, the icons change to a rather drab, generic-looking thing. For example Word documents, which used to show as the familiar blue Word documen
-
Reset Time Machine "Do Not Use"?
Hello, I have a new MacBook Pro retina, and wanted to take some files from my existing Time Machine backup disk. When I plugged the disc in for the first time, I got the dialog box asking me if I wanted to use this disc for Time Machine. The options