OT: Site check (drop dead date is approaching!)

Guys:
I am in the final stages (in extremis - as they say in
medical circles!) of
a site that should be ready for going live in the next 2-3
weeks. Please
take a quick visit and let me know what you think about the
design, the
operation, and the concept....
Thanks!
http://208.112.39.191
Murray --- ICQ 71997575
Adobe Community Expert
(If you *MUST* email me, don't LAUGH when you do so!)
==================
http://www.dreamweavermx-templates.com
- Template Triage!
http://www.projectseven.com/go
- DW FAQs, Tutorials & Resources
http://www.dwfaq.com - DW FAQs,
Tutorials & Resources
http://www.macromedia.com/support/search/
- Macromedia (MM) Technotes
==================

Yep - it's the nits I am looking for! And thanks for your
other kind words.
> In the image rotation on the left, the images that are
text on colored
> backgrounds have had the quality reduced too much. The
JPEG artifacts are
> way too visible, especially on the light backgrounds. It
really takes
> away from the site.
As designers/developers we always focus on such things. It's
interesting
that the massive committee of clients involved here (who want
to make
semicolons italic!) have not commented on this yet!
Nevertheless, I can
boost the quality of those guys.
For what it's worth, this rotation is an implementation of
PVII's
SlideShowMagic that has been hacked down to the bare minimum.
It was the
best rotate and fade script I could find that wasn't Flash.
> The bold text and the normal-sentences-in-a-headline
thing reminds me too
> much of all the spam e-mails I get promising to make me
a millionaire if I
> buy a $2000 dollar DVD that tells me all the "insider
secrets" to the
> stock/currency/mutual fund/etc markets. Unfortunately,
this puts me on
> high alert and I'm less willing to investigate the site.
Cutting out the
> bold and bold/italic body text would really help. And
it's only the home
> page - none of the other pages gave me that feeling. I
also don't know if
> I'm just weird and everyone else will think it's great.
This is a very good comment - and you are just weird.
I'll see if I can soften that a bit. Not the weird part,
though.
> Very minor here - on the Neighborhood News, if I select
a category for
> which there is nothing scheduled, the message says
"there are no scheduled
> events for this district" even when > Show All
Districts < is selected.
Yeah - that's minor. 8) How about I change that alert to say
"for
'<district name>'" rather than 'for this district'?
> On the about us page, little portraits would be nice
with each blurb.
> Also, you might consider placing this page into a PVII
accordion panel to
> make sure that all the agents' names at least are
visible at a glance.
Yeah - actually that page is going to change to more of a
mission and
justification page, with subordinate links to a Bios page.
And we do plan
to use images there, but the panel idea is intriguing....
> "Useful Information", the first "more" link is bold
while the rest are
> not.
Hmmm - I'll check!
> The seconary menu that just has HOME / Tools / Links
seems awfully bare
> and unfinished compared to the rest of the site.
Yeah - it is. Bare. Perhaps the search field will spruce it
up? 8)
> Well, that's all I can find to complain about right now.
It was quite enough! 8)
Thanks, Lionstone!
Murray --- ICQ 71997575
Adobe Community Expert
(If you *MUST* email me, don't LAUGH when you do so!)
==================
http://www.dreamweavermx-templates.com
- Template Triage!
http://www.projectseven.com/go
- DW FAQs, Tutorials & Resources
http://www.dwfaq.com - DW FAQs,
Tutorials & Resources
http://www.macromedia.com/support/search/
- Macromedia (MM) Technotes
==================
"Lionstone" <[email protected]> wrote in
message
news:[email protected]...
> "Murray *ACE*" <[email protected]>
wrote in message
> news:[email protected]...
>> Guys:
>>
>> I am in the final stages (in extremis - as they say
in medical circles!)
>> of a site that should be ready for going live in the
next 2-3 weeks.
>> Please take a quick visit and let me know what you
think about the
>> design, the operation, and the concept....
>>
>> Thanks!
>>
>>
http://208.112.39.191
>
> I'm going to skip the complements because anyone who
frequents the forums
> knows that you're very good at what you do. I'll jump
right into the
> nit-picking since you're asking for extra eyes right
now. ;)
>
> In the image rotation on the left, the images that are
text on colored
> backgrounds have had the quality reduced too much. The
JPEG artifacts are
> way too visible, especially on the light backgrounds. It
really takes
> away from the site.
>
> The bold text and the normal-sentences-in-a-headline
thing reminds me too
> much of all the spam e-mails I get promising to make me
a millionaire if I
> buy a $2000 dollar DVD that tells me all the "insider
secrets" to the
> stock/currency/mutual fund/etc markets. Unfortunately,
this puts me on
> high alert and I'm less willing to investigate the site.
Cutting out the
> bold and bold/italic body text would really help. And
it's only the home
> page - none of the other pages gave me that feeling. I
also don't know if
> I'm just weird and everyone else will think it's great.
>
> Very minor here - on the Neighborhood News, if I select
a category for
> which there is nothing scheduled, the message says
"there are no scheduled
> events for this district" even when > Show All
Districts < is selected.
>
> On the about us page, little portraits would be nice
with each blurb.
> Also, you might consider placing this page into a PVII
accordion panel to
> make sure that all the agents' names at least are
visible at a glance.
>
> "Useful Information", the first "more" link is bold
while the rest are
> not.
>
> The seconary menu that just has HOME / Tools / Links
seems awfully bare
> and unfinished compared to the rest of the site.
>
> Well, that's all I can find to complain about right now.
> Hopefully you got some useful feedback from all that.
>

Similar Messages

Insert Issue writing to pipe delimited column multiple attributes.Drop Dead

Gurus,
drop dead date tomorrow, please help
Page won't write pipe delimited data to single column. Below is a sample from my VO. All three attributes reference a single column-different pipe delimited positions. Reference these values from page. No error appears when creating new "account" from page but after commit, no pipe delimited data is committed.
Any ideas?
substr(AcctMapEO.header_label_template, 1, instr(AcctMapEO.header_label_template,'|')-1) referencename1,
SUBSTR(substr(AcctMapEO.header_label_template,instr(AcctMapEO.header_label_template,'|')+1,instr(AcctMapEO.header_label_template,'|',1,2)-instr(AcctMapEO.header_label_template,'|')-1),1,40) referencename2,
substr(substr(AcctMapEO.header_label_template,instr(AcctMapEO.header_label_template,'|',1,2)+1,instr(AcctMapEO.header_label_template,'|',1,3)-instr(AcctMapEO.header_label_template,'|',1,2)-1),1,40) referencename3
Edited by: sreese on Sep 21, 2009 2:20 PM
Edited by: sreese on Sep 22, 2009 12:22 AM

Gurus,
Please help!
Ok, here's what I've done which should work but doesn't. I've created a new non-table Entity Attribute in my EO. Then created Transient Attribute in my VO and assigned to value from EO. In my page, I've referenced my transient attribute from VO Instance. In my EOImpl, I'm passing the attribute as a parameter.
No error occurs but Transient Attrib value isn't being passed into PL/SQL call like all other attributes. When I make the call below in TOAD, value is created properly.
public void insertRow()
try
OADBTransactionImpl oadbtransactionimpl = (OADBTransactionImpl)getDBTransaction();
String s = "begin spl_jdev_api_account_map.spl_create_acct(p_cont_cd=>:1,p_consolidate_cd=>:2, p_customer=>:3,p_req_asn=>:4, p_sonic_label=>:5,p_req_conversion_date=>:6,p_override_asn=>:7,p_vendor_name=>:8,p_building =>:9,p_revision =>:10, p_acct_lookup_use_whse_flag =>:11,p_asn_under_rcpt_tolerance=>:12,p_asn_over_rcpt_tolerance=>:13,p_created_by=>:14,p_creation_date=>:15,p_last_updated_by=>:16,p_last_update_date=>:17,p_cancel_asn_yn=>:18,";
String t = "p_use_flex_valueset=>:19,p_po_asn_yn=>:20,p_prepaid_ups_flag=>:21,p_eia_label=>:22,p_exe_flag=>:23,p_header_label_template=>:24,p_line_label_template=>:25,p_all_lpns=>:26,p_internal_asn=>:27,p_print_pickslip =>:28,p_replace_asn_flag =>:29,p_get_line_ref_flag=>:30,p_commercial_inv_flag=>:31,p_req_asn_search =>:32,p_asn_ship_days =>:33,p_asn_receipt_days=>:34,p_asn_creation_days =>:35,p_asn_conversion_flag =>:36,p_min_shelf_life_days=>:37,p_restrict_expired_pick =>:38,";
String u = "p_ars_rules=>:39,p_restock_ord_tgt_oms=>:40,p_attribute_category =>:41,p_attribute1 =>:42,p_attribute2 =>:43,p_attribute3 =>:44,p_attribute4 =>:45,p_attribute5=>:46,p_attribute6=>:47,p_attribute7 =>:48,p_attribute8=>:49,p_attribute9=>:50,p_attribute10=>:51,p_attribute11 =>:52,p_attribute12 =>:53,p_attribute13 =>:54,p_attribute14 =>:55,p_attribute15 =>:56,p_reflbl1 => :57); end;";
String v = (s+t+u);
OracleCallableStatement oraclecallablestatement = (OracleCallableStatement)oadbtransactionimpl.createCallableStatement(v, -1);
oraclecallablestatement.setString(1,getContCd());
oraclecallablestatement.setString(2,getConsolidateCd());
oraclecallablestatement.setString(3,getCustomer());
oraclecallablestatement.setString(4,getReqAsn());
Edited by: sreese on Sep 24, 2009 3:06 PM

Adding a Second Project Site with same restore data

This is the first time I've had to accomplish this
I have a dev server where I restore a backup from 2 weeks ago to http://devserver/pwa
My team has asked for a restore from 2 weeks + 1 day to http://devserver:99/pwa - I've tried deleting site collections, tried several other ways of doing the restore; however, during the mount-spdatabase I get only 1 site to come back (pwa) but
it doesnt show in the site list
The enumallwebs shows the following (notice the in sitemap)
stsadm -o enumallwebs -databasename content_database
databse site count 1
<site ID = random characters > <owner = farmguy> <In sitemap = False>
Web count = 235
==============
I believe/know the issue deals with the same site ID being on the first pwa site; however when I try to do a Mount-SPContentDatabase content-database -WebApplication "http://dev:99" -AssignNewDatabaseID I still get the same issues - new database
ID but still same site ID for the "dev/pwa" site database
Is there anyway to clone (yes I've seen the other articles) or have two sites with the same data?
I've also thought about trying to export the stsadm enumallwebs data and copying that to a new PWA site but have been unsuccessful in the export (or even finding a way to do it)
Can I get any ideas on how to either
1) Change the site ID from a database backup/restore
2) Restore a PWA site to the same server/database server
3) other ideas?
My team members would like to do a comparison of the two dates between a project to check for differences (I just found out about
FluentPro Audit Lite Pro)
Any and all suggestions would be appreciated...
Thank you

I'm still experiencing issues
I tried the following (http://social.technet.microsoft.com/Forums/projectserver/en-US/edc6f56a-5850-4102-841b-32d4df6e6882/how-i-to-restore-the-project-site-deleted-on-project-server-2010-?forum=projectserver2010general) by recovering the data from an unattached
Database (I also did the site collection backup)
1) Trying to do an Import-SPWeb but this was unsuccessful
created a web application 99 -> provisioned a pwa with the old databases -> data appear in project center but when you click on the sites it gives an error message
created a web application 99 -> create a site collection -> provisioned a pwa with the old databases -> data appear in project center but when you click on the sites it gives an error message - same as above
the below while it held promise it didnt work for going against a separate port... using the data from an unattached content database export (link above)
also reference (http://pwmather.wordpress.com/2012/06/28/move-a-sharepoint-2010-sub-site-to-a-different-location-on-the-same-farm-sp2010-ps2010-powershell/)
2) Tried to do a SPSite Restore and it ends up deleting the provisioned PWA and still appears to be there but no PWA soo
3) removing the ophaned PWA site (http://mrhodes.net/2011/02/24/fixing-an-orphaned-site-collection-within-project-server-2010/) wont help since it will remove the PWA sites/subsites from the content database I want
4) I'm still unsure how to approach what Krishnp stated...
unless #2 was his approach
Any other help would be greatly appreciated - I'm trying everything it's time consuming since the backup files take over an hour to restore to a site - while it is faster to do the original when its just one content database/4 pwa databases...
I've read its possible to do to different ports (of course I closed the page) but I have only seen one post point it out
thanks again

Do Not Check Uniqueness of Data in Write Optimised DSO

Hello,
I am working with write optimised DSO with already billion records in it. I have flag 'Do Not Check Uniqueness of Data' in Settings as checked(means it will surely not check for uniqueness of data). I am thinking of removing this flag off and activate the DSO again. I am willing to remove this flag as it will provide option of Req ID input in listcube on DSO and without this list cube will never return back with results.(I have to analyze aggregations)
I tried removing this flag and then activate DSO in production system with 17 million records which took 5 mins for activation (index creation). So maths says for a billion records activation transport will take around 6 hrs for moving to Production.
I am willing to remove this flag as it will provide option of Req ID input in listcube and without this list cube will never return back with results.
Questions:
How does this flag checks the uniqueness of record? WIll it check Active table or from the Index?
To what extent DTP will slow down the process of subsequent data load?
Any other factors/risks/precautions to be taken?
Let me know if questions are not clea or further inputs are required from my side.
Thanks.
Agasti

Hi,
Please go through the site :
/people/martin.mouilpadeti/blog/2007/08/24/sap-netweaver-70-bi-new-datastore-write-optimized-dso
As far as your ques are concerned... i hope above blog will answer most of it , and if it does'nt please read below mentioned thread.
Use of setting "Do Not Check Uniqueness of Data" for Write Optimized DSO
Regards
Raj

Reconciliation and data verification approaches for data in sap r/3 and bw

Hi
Cam anybody suggest what are the different reconciliation and data verification approaches to assure that BW and R/3 source data are in sync.
Thanks in advance.
Regards,
Nisha.

Hi
What you can do is, go to R/3 transaction RSA3 and run the extractor, it gives you the number of records extracted and then go to BW Monitor to check the number of records in the PSA.
if it's the same, there you go.
there is an HOW-TO Document on service market place "Reconcile Data Between SAP Source Systems and SAP BW".
Check this document as well which is very helpful.
There is another HOW-TO document "Validate infocube data by comparing it with PSA Data". this is also a good document.
Hope it helps.
Hari Immadi
http://immadi.com
SEM BW Analyst

Ipod Classic 160GB dropped dead

My 1,5 year old Ipod classic 160GB just dropped dead yesterday. Nothing happened to it, I was listening music just before going to theater, I left it on my desk, I came back, it didn't boot up. I've tried to reset it 500 times, nothing works.
The only way to get the screen to do anything more than just being blank is to connect it to my laptop or pc, with the connector cable. It doesn't function as a seperate harddisk anymore, it can't be reached or found, the only thing it does is showing an apple logo on the screen (like the one in reset) for less then a second, then turning of the screen again, and then showing it again, repeating this process forever.
I doubt it any of you guys know how to fix this, but has anyone had experience with anything like this before?
And does anyone know how apple deals with this? Yes I'm a couple of months over my gaurantee, but it can't be possible that a premium brand multimedia player like an Ipod (and an expensive one with that)just drops dead out of nowhere, after 1,5 year of very carefull use? I've never dropped it even once, it has always had a protection sleeve.

I've had a friend of mine take a look at it today. He runs on a Mac but connecting the Ipod doesn't do anymore then on my windows machine.
However, when we tried it with a firewire connection cable (instead of the normal type cable via usb 2.0) my Ipod was able to reset and even boot. I could listen to music, browse my stuff and the like, however as soon as I unplug, my Ipod is dead as can be. I've tried to make it charge for several hours with no effect.
So it seems my accu is dead, but the rest of my Ipod is ok. I'm gonna check what a replacement accu will cost me and if Apple will fund this or if I'm gonna have to pay for the failing hardware at my local Apple retail point.
*So trying firewire connection cable didn't do much for me apart from knowing that my accu is done for, but it might help others out here.*

I subscribed two weeks back and on the iTunes site Step 1 gathering data is still going on. Why is it taking so long?

I subscribed two weeks back and on the iTunes site Step 1 gathering data is still going on. Why is it taking so long?

I was also having this problem after having successfully used iTunes Match previously. The problem appears to be when there are two version of songs and one of them has the iCloud icon made using a dotted line. Here's what solved it for me:
1. Identify your duplicate files. I have a large library, so I elected to use Dupin Light (available on the Mac App store). I suppose I could have used iTunes duplicate finder too, but I prefer the flexibility of Dupin.
2. Once you have identified your duplicates, find them in iTunes. In my case Dupin identifed 50, from 19,000+ tracks, so for me it was not a large number to check manually.
3. When you find the duplicates, if one of them has the aforementioned dotted line iCloud icon, this is the one you need to delete. If you accidently delete the other version, you can always download it again if you have purchased it from iTunes. In any case, it seems to be the tracks with this icon that it is causing iTunes Match to stall, so you will need to delete all of these.
4. Once you have completed step 3, iTunes Match should not proceed and complete.

How do I check for null date entires using custom JScript on a SharePoint NewForm.aspx?

Hi,
I have the below JScript:
/*Function to convert the US Date format to UK date format */
function parseDate(input) {
var parts = input.split('/');
// new Date(year, month [, date [, hours[, minutes[, seconds[, ms]]]]])
return new Date(parts[2], parts[1]-1, parts[0]); // months are 0-based
/*Function to check if end date is before the start date */
function checkDates(){
var sd = parseDate($("input[title='From']").val());
var ed = parseDate($("input[title='Until']").val());
if(sd > ed) {
alert("Please check From and Until Date");
$("input[value$='Save']").attr('disabled', true); //hide save button
else
$("input[value$='Save']").attr('disabled', false); //show save button
The above works fine for checking sd > ed but I can't seem to check for null's, I have attempted the below which doesn't work:
/*Function to convert the US Date format to UK date format */
function parseDate(input) {
var parts = input.split('/');
// new Date(year, month [, date [, hours[, minutes[, seconds[, ms]]]]])
return new Date(parts[2], parts[1]-1, parts[0]); // months are 0-based
/*Function to check if end date is before the start date */
function checkDates(){
var sd = parseDate($("input[title='From']").val());
var ed = parseDate($("input[title='Until']").val());
if( (sd > ed) || (sd == null) || (ed == Null) ) {
alert("Please check From and Until Date");
$("input[value$='Save']").attr('disabled', true); //hide save button
else
$("input[value$='Save']").attr('disabled', false); //show save button
Any help appreciated.

Hi aspnet-scotland,
Please post ASP.NET related questions in
ASP.NET forums where you could receive better responses.
Thanks for your understanding.
We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
Click
HERE to participate the survey.

Confuse on PR & PO data migration approach new to MM module

Hi All,
I'm pretty confuse with the PO data migration approach when it comes to PO is GR or partial GR or GR&IR. I'm hoping that someone can enlighten me. i understand that we typically don't migrate PO when it is GR & IR, FI team usually will bring over to the new system as an vendor open item in AP. How about the PR or PO which have gone through or half release strategy? What is the follow up process? I have created a criteria table below. How Could someone point me in the right direction? Thanks in advance.
PR
Criteria
Data migration required
Notes
Open and Released
Y
Open and not Released
Y
Flag for Deletion
N
Flag for Block
Y
PO
Criteria
Data migration required
Notes
Open and Released
Y
Open and not Released
Y
GR but no IR
GR & IR
N
AP will bring over as open item
Flag for Deletion
N
Flag for Block
Y
Partial
Y
For partial GR to recreate PO only with missing GR quantity
Regards,
John

Hi John,
The approach that i have followed recently is that we have considered PO as the base document and converted other documents based on the PO condition. This means you first need to see if the PO is to be converted or not. Then you can proceed to convert the related documents like PR, Agreement, Info record, Source list, etc.
Also open qty for PO should be considered for Material and Service line items both.
Once a GR/SES is created, it gets updated in the PO history table EKBE with its related transaction/event type.i.e. EKBE-VGABE = 1 for GR and 9 for SES. Quantity and value also gets updated in case of material and services. You can compare this consumed quantities with PO quantity.
Please see below from SCN and let me know if you need more info on PR or PO conversion.
Purchase Requisition Conversion Strategy
Thanks,
Akash

Check boxes in Data grid

Hi,
I have check boxes in data grid, using action script how do i get the values of check boxes that were selected ?
Can anybody guide me here.
<mx:DataGrid id="targetBaseAdd" width="100%" height="100%" dataProvider="
{Application.application.ccModel.initializeBusinessUnitData.initializeBusinessUnit.baseArra y}">
<mx:columns>
<mx:DataGridColumn headerText="" width="20">
<mx:itemRenderer>
<mx:Component>
<mx:HBox width="100%">
<mx:CheckBox horizontalCenter="0"/> </mx:HBox>
</mx:Component>
</mx:itemRenderer>
</mx:DataGridColumn>
<mx:DataGridColumn headerText="Base" labelFunction="baseTargetList"/>
</mx:columns>
</mx:DataGrid>
Thank You,
Anu.
</mx:HBox>
</mx:Component>
</mx:itemRenderer>
</mx:DataGridColumn>
<mx:DataGridColumn headerText="Base" labelFunction="baseTargetList"/>
</mx:columns>
</mx:DataGrid>
Thank You,
Anu.

refer following examples:
http://blog.flexmonkeypatches.com/2007/11/06/datagrid-checkbox-itemeditor/
http://www.experts-exchange.com/Web_Development/Web_Languages-Standards/Flex/Q_23237167.ht ml

Can I exit from paintComponent? ...or... how can I check for invalid data?

I'm writing a calendar applet for a programming class and I've nearly completed it but I'm stuck at checking for valid data.
What seems to be happening is that paintComponent() is being called before actionPerformed.
In actionPerformed (when they click the button), it checks to make sure they entered a valid month (1 to 12). If the didn't it dispalys a message, but if they did it calls repaint().
But even if repaint() isn't called, Java still seems to call it before actionPerformed and I get exceptions.
So I tried checking inside of paintComponent() by using a simple if(...) return; but that doesn't seem to do anything... it just keeps going through with the method.
So -- Once the user presses my button I want to make sure the data is valid before repainting the screen. How can I do this?

I validate it in actionPerformed which is called by
the action listener... that is what you meant right?
The problem is that it seems paintComponent() is being
called before I can validate the data with
actionPerformed(). I need to stop paintComponent()
from always being calledMVC. (Model, View, Controller)
Initially the internal value of the data (the model) should be valid (or null with a check in the paintComponent method)
paintComponent (the view part) shows the state of the valid data.
You press the button.
actionPerformed is called (the controller).
It checks the value and, if valid, writes it to the data (model), then updates the view.
At no point will the view have to render invalid data, because the model is only updated after actionPerformed checks the value.
The pattern may be applied with different classes performing the three roles, or different methods in the same class (sometimes it's easier that way for simple cases).
Pete

Error while checking the rate data through installation

Hi everyone,
I am facing an error message while checking the rate data for an installation:
"Internal error: Error when reading internal table IEGER in ISU_O_DEVICERATE_OPEN".
Please guide.
Thanks and Regards

Hi,
The error comes from FM ISU_O_DEVICERATE_OPEN include LEG70F40 line number 2555.
It is giving error on following code of line in FM.
      find the serialno.
        loop at ieger into eger_wa
          where equnr = reg_wa-equnr
          and   ab   <= reg_wa-ab
          and   bis >= reg_wa-ab.
          exit.
        endloop.
        if sy-subrc <> 0.
          perform close_object changing obj.
          mac_msg_put 'E890(E9)' 'IEGER' 'ISU_O_DEVICERATE_OPEN'
                                 space space input_error.
          if 1 = 2. message e890(e9) with ' ' ' ' ' '. endif.
        endif.
I think that you are not checking the active installation. Check whether that installation has proper ebtry in table EASTS.
Try changing
BIS     BISZEITSCH     DATS     8     0     Date at Which a Time Slice Expires
AB     ABZEITSCH     DATS     8     0     Date from which time slice is valid
data for the installation.
If this dosent work then debug the program by putting break point on the mentioned line and check.
Regards,
Pranaya

ASA rpf-check DROP, ASA checking NAT in the incorrect interface

Hi
My current architecture is :
Internet <--> FW <--> ASA <--> LAN
FW <--> ASA
we have two links between ASA and the FW, the corresponding ASA interfaces are "outside" and "vpn"
the "outside" interface is used for browsing Internet, also for making some services accessible to our partners by doing NAT to our servers
the "vpn" interface is used to grant access to our LANs from remote Offices
let say that firewall rules are OK and the remote offices have access to the whole LAN by port 80
below the current configuration :
interface GigabitEthernet0/0
nameif inside
security-level 100
ip address 192.168.1.2 255.255.255.0
interface GigabitEthernet0/1
nameif outside
security-level 0
ip address 192.168.11.2 255.255.255.0
interface GigabitEthernet0/2
nameif vpn
security-level 0
ip address 192.168.12.2 255.255.255.0
object-group network Inside_LANs
network-object 192.168.3.0 255.255.255.0
network-object 192.168.4.0 255.255.255.0
network-object 192.168.5.0 255.255.255.0
access-list Inside-to-outside extended permit icmp object-group Inside_LANs any echo
access-list Inside-to-outside extended permit udp any host TimeServer eq ntp
access-list Inside-to-outside extended permit ip object-group Inside_LANs any
global (outside) 1 interface
global (outside) 2 192.168.11.60 netmask 255.255.255.255
nat (inside) 1 access-list Inside-to-outside
nat (inside) 2 192.168.6.0 255.255.255.0
static (inside,outside) 192.168.11.10 192.168.2.10 netmask 255.255.255.255
static (inside,outside) 192.168.11.11 192.168.2.11 netmask 255.255.255.255
static (inside,outside) 192.168.11.12 192.168.2.12 netmask 255.255.255.255
route inside 192.168.2.0 255.255.255.0 192.168.1.1 1
route inside 192.168.3.0 255.255.255.0 192.168.1.1 1
route inside 192.168.4.0 255.255.255.0 192.168.1.1 1
route inside 192.168.5.0 255.255.255.0 192.168.1.1 1
route inside 192.168.6.0 255.255.255.0 192.168.1.1 1
route vpn 192.168.20.0 255.255.255.0 192.168.12.1 1
our problem is that packets are dropped from remote office to LAN, we are getting the rpf-check drop in packet tracer
example 1 (to a server without NAT 192.168.2.13) ---> connection OK (not dropped)
remote office 192.168.20.55 to 192.168.2.13
Phase: 5
Type: NAT
Subtype: host-limits
Result: ALLOW
Config:
nat (inside) 1 access-list Inside-to-outside
match udp inside any inside host TimeServer eq 123
dynamic translation to pool 1 (No matching global)
translate_hits = 0, untranslate_hits = 0
Additional Information:
example 2 (to a server with static NAT 192.168.2.10) ---> connection OK (not dropped)
remote office 192.168.20.55 to 192.168.2.10
Phase: 6
Type: NAT
Subtype: host-limits
Result: ALLOW
Config:
static (inside,outside) 192.168.11.10 192.168.2.10 netmask 255.255.255.255
match ip inside host 192.168.2.10 outside any
static translation to 192.168.11.10
translate_hits = 76643, untranslate_hits = 188597
Additional Information:
example 3 (to a host with dynamic ACL NAT 192.168.4.40) ---> connection NOK (dropped)
remote office 192.168.20.55 to 192.168.4.40
Phase: 5
Type: NAT
Subtype: rpf-check
Result: DROP
Config:
nat (inside) 1 access-list Inside-to-outside
match ip inside 192.168.4.0 255.255.255.0 vpn any
dynamic translation to pool 1 (No matching global)
translate_hits = 1, untranslate_hits = 0
Additional Information:
example 4 (to a host with dynamic Network NAT 192.168.6.30) ---> connection NOK (dropped)
remote office 192.168.20.55 to 192.168.6.30
Phase: 5
Type: NAT
Subtype: rpf-check
Result: DROP
Config:
nat (inside) 2 192.168.6.0 255.255.255.0
match ip inside 192.168.6.0 255.255.255.0 vpn any
dynamic translation to pool 2 (No matching global)
translate_hits = 117, untranslate_hits = 0
Additional Information:
our questions :
1) why ASA don't check the reverse path route before checking the NAT ?
if it does, the route back to the office is set to the "vpn" interface (route vpn 192.168.20.0 255.255.255.0 192.168.12.1 1), so ASA don't have to check NAT in other interface, currently it's checking the NAT in the "outside" interface even if it's not the route back to the office
2) why it's working for static NAT servers and Not working for the dynamic NAT ones ?
when ASA check a server with static NAT it find a match in the outside interface but even so it discard it and the connection Work. (example 2)
when ASA check a server/host with dynamic NAT (ACL or Network) if find a match in the outside interface but drop the connection
3) we know that this behavior can be solved by adding a NAT exception for the dynamic NAT in the "outside" interface (nat (inside) 0 access-list Inside-NAT-Exceptions) but :
why ASA checking the global NAT even if it's not the correct interface ?
Why it's working for static NAT and not working for the dynamic one ?
Thanks a lot

Hi,
It would be easier to troubleshoot if you shared the complete "packet-tracer" command you used and the full output of the command.
But to me the situation in its current form looks the following.
Example 1
To me it seems this is working as it should. Connection is coming from "vpn" to "inside". There is no "static" configurations between "vpn" and "inside" and there is no "nat" command for "vpn" interface so the traffic should pass normally without any NAT related conflicts/problems as the traffic does not match any NAT configuration.
Notice that the ASA might show some unrelated NAT information in the output of the "packet-tracer" command (commands related to other interfaces). In those NAT Phase sections there is a section saying "Additional Information:" If there is no text after this text that means that this NAT has not been applied. I am not sure why the ASA lists some NAT configurations in the output that are not related. I have seen this in many occasions and do not know the reason and I have not really put any time/effort into understanding why it shows the unrelated information in the output.
Example 2
This seems to be working as expected also.
According to the configuration provided there is no existing NAT configurations related to either the source or destination IP address on the ASA between "vpn" and "inside" interface so the traffic passes through the ASA without facing any conflicts with NAT configurations.
Again, the "packet-tracer" shows NAT information unrelated to this situation. And again the "Additional Information:" section lists no additional information so the NAT listed is not applied.
Example 3 and 4
These tests fail as expected since there is a Dynamic Policy PAT configuration for both internal destination hosts that the remote users are trying to connect to. The problem comes from the fact that the initial direction from remote to internal does not match any NAT configuration and the reverse direction from internal to remote matches the Dynamic Policy PAT and therefore the connection attempt is dropped. The connection must match the same NAT configuration on both directions.
In this situation you would either have to configure NAT0, Static NAT , Static PAT or Static Policy NAT/PAT which all would prevent the connection from matching to the Dynamic Policy PAT (But would match the mentioned type of NAT in both directions as they have higher priority than Dynamic Policy PAT). Typically the prefererred solution would be to use NAT0 though you naturally have the option to use a NAT address if there is any overlap.
Hope this helps :)
- Jouni

How to check if Oracle Data Access Components is installed?

How to check if Oracle Data Access Components is installed and version on my computer?
Also How to check if Oracle Data Provider is installed and version?
TIA
Steve42

Regedit HKLM->Software->Oracle. See what's there...
At the very least, that can give you paths and can check file versions from there.

How can I check the expiration date of a Certificate Keychain from terminal?

Hello, I am writing a bash script to alert me when my corporate certificates are about to expire. How can I check the expiration date of a certificate in keychain? I'm running Mac OS 10.6.8 on a newer MacBook pro with full admin rights.
Specifically I will be checking three certs: a Root Authority, Issuing Authority, and a user cert (Identity).
I was exploring the Security and Openssl command line tools. But I can't seem to get the info I need.
Any recommendations would be appreciated.
Thank you!

Anyone?

OT: Site check (drop dead date is approaching!)

Similar Messages

Maybe you are looking for