P- VPN route reflector- PE

if i config mp-bgp vpnv4 reflector on a P router, does this P router become a PE router? Or keep P router role in mpls network?
thank you!

Hello,
As I see it, how you do the route reflection process is more your own business than the customers'. How well you are doing it will of course affect the customers, but this is more an internal issue of the core, rather than something to discuss with the customer. Anyway, in this case the customers might have a point.
The problem when you have 2 PE's as your RR's is that if you want to perform a maintenance procedure on those PE's, it might also affect customers not even connected to the particular PE's. If on the other hand the core routers are the RR's, if you perform maintenance on them, few things in the network will be operational anyway since they stand in the middle, so no more harm done than expected. One could argue that in both cases there are 2 RR's, so things cannot be that bad. If one goes down we do have the other. (In the case of the P's however, if one goes down you might have a split network, so route reflection is the last thing that would concern you.)
You have 122 PE's and expect more. My guess is that your routers can handle the process if in most cases only a couple of routes are exchanged between VPN sites. Whether you choose to make RR's the P's or the PE's is more of a matter of style. I would prefer the PE's, because I would rather keep the P's "clean", doing what they are supposed to do, that is label switching traffic. MPLS is supposed to relief the core from running BGP, and we do not want to take risks in the P's by running something not absolutely necessary for them. In addition, route reflection is supposed to relief the PE's from having to peer with each other directly, so it looks more their own business to handle the route reflection process, which is coming to remedy the necessity for them (that is the PE's) to peer with every other PE in the network.
The bottom line is: Your P's are more important to you than any other router. This is for the customers' best interest as well. Keep functions where they belong more naturally.
Kind Regards,
M.

Similar Messages

  • Switchport module within 1800 VPN router

    Hi Folks,
    I have a Cisco 1801 VPN router (using PPPoA) which I currently have one PC attached to the Fe0 port which in turn picks up a DHCP address from the local pool within the router.
    I am now planning to add a few more PC?s to the site and I was looking to use the extra 8 switchports available on the router.
    Up until now I have been using a 2950 switch and hanging it off the Fe0 port so that I can also extend the subnet.
    When I try to plug a PC into the extra switchports no DHCP address is obtained. From what I can tell I will have to create a VLAN on the router to assign the switchports too. However when I do this I am unable to extend the subnet from the Fe0 port onto the switch module as I receive a ?Subnet already in use? message from the CLI.
    Thanks for your help
    Kris

    I think your are connecting to the wrong switch.
    This URL should help you:
    http://www.cisco.com/en/US/products/sw/iosswrel/ps1835/products_configuration_guide_chapter09186a00800ca75c.html

  • BGP route-reflector next-hop issue

    Hello,
    I have a small GNS3 lab that is working with one exception: I cannot ping loopback0 on RRc2 and RRc3 from RRc1.
    RRc1, RRc2 and RRc3 can all ping loopback0 on SmileyISP and RRc2 and RRc3 can ping each others loopback0
    interfaces.
    I am broken between the two route-reflectors: RRS1 and RRS2.
    Given these conditions:
    1) Do not configure any IGP.
    2) No static routes
    How do I get connectivity from RRc1's loopback0 interface to RRc2 loopback0 and RRc3 loopback0?
    I used a route-map to set the next hop, but I am obviously doing something wrong.
    I am providing relevant show command outputs, router configs, and the GNS3 topology.net config.
    You will have to change the image and working directories to match your computer.
    Not quite sure where I am going wrong.
    Any help would be greatly appreciated.
    Thanks.
    -- Mark
    RRc1#sh ip bgp
    BGP table version is 53, local router ID is 172.16.1.1
    Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
                  r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
                  x best-external, a additional-path, c RIB-compressed,
    Origin codes: i - IGP, e - EGP, ? - incomplete
    RPKI validation codes: V valid, I invalid, N Not found
         Network          Next Hop            Metric LocPrf Weight Path
     *>i 1.1.1.0/24       10.1.25.5                0    100      0 100 i
     *>i 10.1.12.0/24     10.1.26.2                0    100      0 i
     *>i 10.1.13.0/24     10.1.12.1                0    100      0 i
     *>i 10.1.14.0/24     10.1.12.1                0    100      0 i
     *>i 10.1.15.0/24     10.1.12.1                0    100      0 i
     *>i 10.1.25.0/24     10.1.26.2                0    100      0 i
     * i 10.1.26.0/24     10.1.26.2                0    100      0 i
     *>                   0.0.0.0                  0         32768 i
     *>  172.16.1.0/24    0.0.0.0                  0         32768 i
     *>i 172.16.2.0/24    10.1.12.1                0    100      0 i
     *>i 172.16.3.0/24    10.1.12.1                0    100      0 i
    RRc1#
    RRc1#ping 172.16.2.1 so lo0
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 172.16.2.1, timeout is 2 seconds:
    Packet sent with a source address of 172.16.1.1
    Success rate is 0 percent (0/5)
    RRc1#
    RRc2#sh ip bgp
    BGP table version is 31, local router ID is 172.16.2.1
    Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
                  r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
                  x best-external, a additional-path, c RIB-compressed,
    Origin codes: i - IGP, e - EGP, ? - incomplete
    RPKI validation codes: V valid, I invalid, N Not found
         Network          Next Hop            Metric LocPrf Weight Path
     *>i 1.1.1.0/24       10.1.15.5                0    100      0 100 i
     * i 10.1.12.0/24     10.1.12.2                0    100      0 i
     * i 10.1.13.0/24     10.1.13.1                0    100      0 i
     *>                   0.0.0.0                  0         32768 i
     *>i 10.1.14.0/24     10.1.13.1                0    100      0 i
     *>i 10.1.15.0/24     10.1.13.1                0    100      0 i
     * i 10.1.25.0/24     10.1.12.2                0    100      0 i
     * i 10.1.26.0/24     10.1.12.2                0    100      0 i
     * i 172.16.1.0/24    10.1.12.2                0    100      0 i
     *>  172.16.2.0/24    0.0.0.0                  0         32768 i
     *>i 172.16.3.0/24    10.1.14.4                0    100      0 i
    RRc2#
    SmileyISP#sh run
    Building configuration...
    Current configuration : 988 bytes
    version 15.2
    service timestamps debug datetime msec
    service timestamps log datetime msec
    hostname SmileyISP
    boot-start-marker
    boot-end-marker
    no aaa new-model
    ip cef
    no ipv6 cef
    multilink bundle-name authenticated
    interface Loopback0
     ip address 1.1.1.1 255.255.255.0
    interface FastEthernet0/0
     no ip address
     shutdown
     duplex half
    interface FastEthernet1/0
     ip address 10.1.15.5 255.255.255.0
     speed auto
     duplex auto
    interface FastEthernet1/1
     ip address 10.1.25.5 255.255.255.0
     speed auto
     duplex auto
    router bgp 100
     bgp log-neighbor-changes
     network 1.1.1.0 mask 255.255.255.0
     network 10.1.15.0 mask 255.255.255.0
     neighbor 10.1.15.1 remote-as 200
     neighbor 10.1.25.2 remote-as 200
    ip forward-protocol nd
    no ip http server
    no ip http secure-server
    control-plane
    line con 0
     logging synchronous
     transport preferred none
     stopbits 1
    line aux 0
     stopbits 1
    line vty 0 4
     login
    end
    RRS1#sh run
    Building configuration...
    Current configuration : 1594 bytes
    ! Last configuration change at 19:24:34 UTC Sat Feb 7 2015
    version 15.2
    service timestamps debug datetime msec
    service timestamps log datetime msec
    hostname RRS1
    boot-start-marker
    boot-end-marker
    no aaa new-model
    ip cef
    no ipv6 cef
    multilink bundle-name authenticated
    interface FastEthernet0/0
     no ip address
     shutdown
     duplex half
    interface FastEthernet1/0
     ip address 10.1.15.1 255.255.255.0
     speed auto
     duplex auto
    interface FastEthernet1/1
     ip address 10.1.12.1 255.255.255.0
     speed auto
     duplex auto
    interface FastEthernet2/0
     ip address 10.1.13.1 255.255.255.0
     speed auto
     duplex auto
    interface FastEthernet2/1
     ip address 10.1.14.1 255.255.255.0
     speed auto
     duplex auto
    router bgp 200
     bgp log-neighbor-changes
     network 10.1.13.0 mask 255.255.255.0
     network 10.1.14.0 mask 255.255.255.0
     network 10.1.15.0 mask 255.255.255.0
     neighbor RouteReflectors peer-group
     neighbor RouteReflectors remote-as 200
     neighbor RouteReflectors route-map NEXTHOP out
     neighbor RRClients peer-group
     neighbor RRClients remote-as 200
     neighbor RRClients route-reflector-client
     neighbor 10.1.12.2 peer-group RouteReflectors
     neighbor 10.1.13.3 peer-group RRClients
     neighbor 10.1.14.4 peer-group RRClients
     neighbor 10.1.15.5 remote-as 100
    ip forward-protocol nd
    no ip http server
    no ip http secure-server
    route-map NEXTHOP permit 10
     set ip next-hop peer-address
    control-plane
    line con 0
     logging synchronous
     transport preferred none
     stopbits 1
    line aux 0
     stopbits 1
    line vty 0 4
     login
    end
    RRS2#sh ru
    Building configuration...
    Current configuration : 1542 bytes
    ! Last configuration change at 19:42:06 UTC Sat Feb 7 2015
    version 15.2
    service timestamps debug datetime msec
    service timestamps log datetime msec
    hostname RRS2
    boot-start-marker
    boot-end-marker
    no aaa new-model
    ip cef
    no ipv6 cef
    multilink bundle-name authenticated
    interface FastEthernet0/0
     no ip address
     shutdown
     duplex half
    interface FastEthernet1/0
     ip address 10.1.12.2 255.255.255.0
     speed auto
     duplex auto
    interface FastEthernet1/1
     ip address 10.1.25.2 255.255.255.0
     speed auto
     duplex auto
    interface FastEthernet2/0
     ip address 10.1.26.2 255.255.255.0
     speed auto
     duplex auto
    interface FastEthernet2/1
     no ip address
     shutdown
     speed auto
     duplex auto
    router bgp 200
     bgp log-neighbor-changes
     network 10.1.12.0 mask 255.255.255.0
     network 10.1.25.0 mask 255.255.255.0
     network 10.1.26.0 mask 255.255.255.0
     neighbor RouteReflectors peer-group
     neighbor RouteReflectors remote-as 200
     neighbor RouteReflectors route-map NEXTHOP out
     neighbor RRClients peer-group
     neighbor RRClients remote-as 200
     neighbor RRClients route-reflector-client
     neighbor 10.1.12.1 peer-group RouteReflectors
     neighbor 10.1.25.5 remote-as 100
     neighbor 10.1.26.6 peer-group RRClients
    ip forward-protocol nd
    no ip http server
    no ip http secure-server
    route-map NEXTHOP permit 10
     set ip next-hop peer-address
    control-plane
    line con 0
     logging synchronous
     transport preferred none
     stopbits 1
    line aux 0
     stopbits 1
    line vty 0 4
     login
    end
    RRc1#sh run
    Building configuration...
    Current configuration : 1005 bytes
    ! Last configuration change at 18:43:57 UTC Sat Feb 7 2015
    version 15.2
    service timestamps debug datetime msec
    service timestamps log datetime msec
    hostname RRc1
    boot-start-marker
    boot-end-marker
    no aaa new-model
    ip cef
    no ipv6 cef
    multilink bundle-name authenticated
    interface Loopback0
     ip address 172.16.1.1 255.255.255.0
    interface FastEthernet0/0
     no ip address
     shutdown
     duplex half
    interface FastEthernet1/0
     ip address 10.1.26.6 255.255.255.0
     speed auto
     duplex auto
    interface FastEthernet1/1
     no ip address
     shutdown
     speed auto
     duplex auto
    router bgp 200
     bgp log-neighbor-changes
     network 10.1.26.0 mask 255.255.255.0
     network 172.16.1.0 mask 255.255.255.0
     neighbor 10.1.26.2 remote-as 200
    ip forward-protocol nd
    no ip http server
    no ip http secure-server
    control-plane
    line con 0
     logging synchronous
     transport preferred none
     stopbits 1
    line aux 0
     stopbits 1
    line vty 0 4
     login
    end
    RRc2#sh run
    Building configuration...
    Current configuration : 1005 bytes
    ! Last configuration change at 18:45:05 UTC Sat Feb 7 2015
    version 15.2
    service timestamps debug datetime msec
    service timestamps log datetime msec
    hostname RRc2
    boot-start-marker
    boot-end-marker
    no aaa new-model
    ip cef
    no ipv6 cef
    multilink bundle-name authenticated
    interface Loopback0
     ip address 172.16.2.1 255.255.255.0
    interface FastEthernet0/0
     no ip address
     shutdown
     duplex half
    interface FastEthernet1/0
     ip address 10.1.13.3 255.255.255.0
     speed auto
     duplex auto
    interface FastEthernet1/1
     no ip address
     shutdown
     speed auto
     duplex auto
    router bgp 200
     bgp log-neighbor-changes
     network 10.1.13.0 mask 255.255.255.0
     network 172.16.2.0 mask 255.255.255.0
     neighbor 10.1.13.1 remote-as 200
    ip forward-protocol nd
    no ip http server
    no ip http secure-server
    control-plane
    line con 0
     logging synchronous
     transport preferred none
     stopbits 1
    line aux 0
     stopbits 1
    line vty 0 4
     login
    end
    RRc3#wr term
    Building configuration...
    Current configuration : 1005 bytes
    ! Last configuration change at 18:31:12 UTC Sat Feb 7 2015
    version 15.2
    service timestamps debug datetime msec
    service timestamps log datetime msec
    hostname RRc3
    boot-start-marker
    boot-end-marker
    no aaa new-model
    ip cef
    no ipv6 cef
    multilink bundle-name authenticated
    interface Loopback0
     ip address 172.16.3.1 255.255.255.0
    interface FastEthernet0/0
     no ip address
     shutdown
     duplex half
    interface FastEthernet1/0
     ip address 10.1.14.4 255.255.255.0
     speed auto
     duplex auto
    interface FastEthernet1/1
     no ip address
     shutdown
     speed auto
     duplex auto
    router bgp 200
     bgp log-neighbor-changes
     network 10.1.14.0 mask 255.255.255.0
     network 172.16.3.0 mask 255.255.255.0
     neighbor 10.1.14.1 remote-as 200
    ip forward-protocol nd
    no ip http server
    no ip http secure-server
    control-plane
    line con 0
     logging synchronous
     transport preferred none
     stopbits 1
    line aux 0
     stopbits 1
    line vty 0 4
     login
    end
    autostart = False
    version = 0.8.6
    [127.0.0.1:7202]
        workingdir = C:\Users\Mark\AppData\Local\Temp
        udp = 10200
            image = C:\downloads\GNS3\c7200-adventerprisek9-mz.152-4.S5.image
            idlepc = 0x62f1e4ec
            ghostios = True
            console = 2005
            aux = 2100
            cnfg = configs\SmileyISP.cfg
            slot1 = PA-2FE-TX
            f1/0 = RRS1 f1/0
            f1/1 = RRS2 f1/1
            x = -24.0
            y = -259.0
            z = 1.0
            hx = -1.5
            hy = -24.0
            console = 2015
            aux = 2101
            cnfg = configs\RRc1.cfg
            slot1 = PA-2FE-TX
            f1/0 = RRS2 f2/0
            x = -292.0
            y = 200.0
            z = 1.0
            hx = -5.5
            hy = -25.0
    [127.0.0.1:7200]
        workingdir = C:\Users\Mark\AppData\Local\Temp
        udp = 10000
            image = C:\downloads\GNS3\c7200-adventerprisek9-mz.152-4.S5.image
            idlepc = 0x62f1e4ec
            ghostios = True
            console = 2012
            aux = 2102
            cnfg = configs\RRS1.cfg
            slot1 = PA-2FE-TX
            f1/0 = SmileyISP f1/0
            f1/1 = RRS2 f1/0
            slot2 = PA-2FE-TX
            f2/0 = RRc2 f1/0
            f2/1 = RRc3 f1/0
            x = 197.0
            y = 6.0
            z = 1.0
            hx = 42.5
            hy = -20.0
            console = 2013
            aux = 2103
            cnfg = configs\RRS2.cfg
            slot1 = PA-2FE-TX
            f1/0 = RRS1 f1/1
            f1/1 = SmileyISP f1/1
            slot2 = PA-2FE-TX
            f2/0 = RRc1 f1/0
            x = -239.0
            y = 9.0
            z = 1.0
            hx = 1.5
            hy = -24.0
    [127.0.0.1:7201]
        workingdir = C:\Users\Mark\AppData\Local\Temp
        udp = 10100
            image = C:\downloads\GNS3\c7200-adventerprisek9-mz.152-4.S5.image
            idlepc = 0x62f1e4ec
            ghostios = True
            console = 2009
            aux = 2104
            cnfg = configs\RRc3.cfg
            slot1 = PA-2FE-TX
            f1/0 = RRS1 f2/1
            x = 337.0
            y = 155.0
            z = 1.0
            hx = 17.5
            hy = -25.0
            console = 2008
            aux = 2105
            cnfg = configs\RRc2.cfg
            slot1 = PA-2FE-TX
            f1/0 = RRS1 f2/0
            x = 149.0
            y = 204.0
            z = 1.0
            hx = -13.5
            hy = -23.0
    [GNS3-DATA]
        configs = configs
            text = ".1"
            x = 208.0
            y = -23.0
            text = "10.1.12.0/24"
            x = -19.0
            y = 5.0
            text = ".1"
            x = 153.0
            y = 25.0
            text = ".1"
            x = 259.0
            y = 33.0
            text = "10.1.13.0/24"
            x = 238.0
            y = 84.0
            rotate = 99
            text = "10.1.25.0/24"
            x = -188.0
            y = -124.0
            text = "l0: 172.16.2.1/24"
            x = 125.0
            y = 244.0
            text = "l0:172.16.1.1/24"
            x = -269.0
            y = 240.0
            text = "10.1.15.0/24"
            x = 116.0
            y = -127.0
            text = "10.1.14.0/24"
            x = 293.0
            y = 53.0
            rotate = 50
            text = ".1"
            x = 194.0
            y = 68.0
            text = "AS100"
            x = -20.0
            y = -342.0
            text = ".2"
            x = -148.0
            y = 46.0
            text = "AS200"
            x = 33.0
            y = 300.0
            text = "l0: 1.1.1.1/24"
            x = -42.0
            y = -306.0
            text = ".5"
            x = 50.0
            y = -213.0
            text = ".2"
            x = -248.0
            y = 60.0
            text = ".2"
            x = -174.0
            y = -52.0
            text = ".5"
            x = -54.0
            y = -209.0
            text = ".6"
            x = -232.0
            y = 189.0
            text = "l0:172.16.3.1/24"
            x = 299.0
            y = 194.0
            text = "10.1.26.0/24"
            x = -274.0
            y = 167.0
            rotate = 290
            text = ".3"
            x = 208.0
            y = 187.0
            text = ".4"
            x = 312.0
            y = 155.0
            type = ellipse
            x = 50.0
            y = -35.0
            width = 385.0
            height = 345.0
            fill_color = "#ffff7f"
            border_style = 2
            z = -1.0
            type = ellipse
            x = -171.0
            y = -346.0
            width = 359.0
            height = 200.0
            fill_color = "#aaff7f"
            border_style = 2
            z = -1.0
            type = ellipse
            x = -407.0
            y = -87.0
            width = 883.0
            height = 443.0
            border_style = 2
            z = -2.0
            type = ellipse
            x = -361.0
            y = -29.0
            width = 385.0
            height = 326.0
            fill_color = "#55aaff"
            border_style = 2
            z = -3.0

    BD,
    Ahh...
    OK.  In the original article, the author states that the final piece with the route map
    NEXTHOP was supposed to fix the reachability issue.  Obviously it doesn't.
    After reading your last post, I looked more carefully at the output from 'sh ip bgp'
    on each of the client routers and I realized that several of the next hop addresses were
    wrong for some of the prefixes.
    1) I completely removed the 'neighbor RouteReflectors route-map NEXTHOP out'
    from both RR's.  Then I ran 'sh ip bgp' on the clients and noted a change in the next hop addresses.  Still wrong, but it changed.
    2) I then tried next-hop-self from the RR's to the clients, but it did not change from where
    it was after I completed step 1.  I am not sure why there was no change. (actually, see the very end of this post)
    3) I then applied my version of the route map:  route-map NEXTHOP permit 10
                                                                                 set ip next-hop peer-address
    to the RR's with this: neighbor RRClients route-map NEXTHOP out
    That fixed it.  All three clients have as their next hop for all prefixes their respective
    RR's (which is what they should have for this topology).
    I have full connectivity everywhere, even loopback to loopback between all clients.
    1) THANK YOU for pointing me in the right direction.
    2) If I may ask, why did next hop self fail?  More specifically, I saw no change at all
    in the next hop for the advertised prefixes.  Is it because next-hop-self should be used
    for eBGP peers and all of the RR's and clients are all within the same AS?

  • How to make a VPN route permanent ?

    I have a VPN between my office and a lab on the east coast and I can use the following command from my Terminal to enable the route in my Leopard Server:
    route add -net 10.48.239.0 -netmask 255.255.255.0 192.168.1.254
    How can I make this a permanent route? At this time if I reboot the server I must get into the Terminal and use the following two lines to make everything work again:
    sudo su
    route add -net 10.48.239.0 -netmask 255.255.255.0 192.168.1.254
    Thanks for any information any of you may have.
    By the way within 6 months I will be doing the same task on a new Snow Leopard Server so if there are differences please feel free to chime in.

    If you're having to manually set VPN routes then you're doing something wrong.
    It isn't clear from your post where you're doing this. You say you set this 'in my Leopard Server', but it's not clear whether that server is the VPN server on the east coast, a server in your office, or another server anywhere else.
    Normally, the VPN server sends out a list of routes the client should use, so knowing the above will help narrow down where your problem lies.

  • Bgp Route reflector

    Hello,
    i have this bgp topology all router running bgp and no igp is running. Now, the problem is R2 and R3 are route reflector, R1 and R4 are Rclient.
    R3 has learn route from R4 (4.4.4.4) from its R client and it advertise to R2 but R2 not advertise (4.4.4.4) route to its client (R1).
    R1#sh ip bgp
    BGP table version is 5, local router ID is 192.168.12.1
    Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
                  r RIB-failure, S Stale
    Origin codes: i - IGP, e - EGP, ? - incomplete
       Network          Next Hop            Metric LocPrf Weight Path
    *> 1.1.1.1/32       0.0.0.0                  0         32768 i
    *>i2.2.2.2/32       192.168.12.2             0    100      0 i
    * i3.3.3.3/32       192.168.23.3             0    100      0 i
    R2#sh ip bgp
    BGP table version is 8, local router ID is 192.168.12.2
    Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
                  r RIB-failure, S Stale
    Origin codes: i - IGP, e - EGP, ? - incomplete
       Network          Next Hop            Metric LocPrf Weight Path
    *>i1.1.1.1/32       192.168.12.1             0    100      0 i
    *> 2.2.2.2/32       0.0.0.0                  0         32768 i
    *>i3.3.3.3/32       192.168.23.3             0    100      0 i
    * i4.4.4.4/32       192.168.34.4             0    100      0 i

    R3#sh ip bgp
    BGP table version is 8, local router ID is 192.168.23.3
    Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
                  r RIB-failure, S Stale
    Origin codes: i - IGP, e - EGP, ? - incomplete
       Network          Next Hop            Metric LocPrf Weight Path
    * i1.1.1.1/32       192.168.12.1             0    100      0 i
    *>i2.2.2.2/32       192.168.23.2             0    100      0 i
    *> 3.3.3.3/32       0.0.0.0                  0         32768 i
    *>i4.4.4.4/32       192.168.34.4             0    100      0 
    R3#sh run | se router bgp
    router bgp 1
     no synchronization
     bgp log-neighbor-changes
     network 3.3.3.3 mask 255.255.255.255
     neighbor 192.168.23.2 remote-as 1
     neighbor 192.168.23.2 next-hop-self
     neighbor 192.168.34.4 remote-as 1
     neighbor 192.168.34.4 route-reflector-client
     no auto-summary

  • WD My Book NAS drive, Cisco VPN router and FTP access

    Hello:
    I have a Western Digital My Book World Editon II NAS drive that is connected through a Cisco ASA 5500 VPN router.
    This NAS drive has a service to use it as an FTP server using port 21 as default or other specific port.
    I also have a XP PC in which I installed Filezilla where I am trying to access the NAS files.
    Only problem is that Filezilla apparently connects to the NAS drive but it lists the directory as empty.Changing to Active mode makes no difference.
    Does this sounds like a problem with the VPN configuration?
    Do I have to configure some kind of port forwarding on the VPN router for port 21?
    Or does the VPN router has nothing to do with this problem?
    Thanks for your help

    Would you "Solve" this question please ?

  • Accessing device attached to VPN router

    Hi.  We have a VPN router, RV180, that was installed to allow us to access data on a PLC which is physically attached to the router via ethernet cable. We are able to establish a VPN connection from a remote laptop using QuickVPN. However, we cannot figure out how to browse to the PLC using Internet Explorer. The IP address we have for the PLC is identical to an external IP address and our browser simply loads the page from the Internet. How do we browse to the PLC using the VPN connection?
    Thanks
    Mike

    Hello.  If I may reactivate an old string I have a bit of an ironic question.  The Mac connection which seemed so difficult is now the only one that works.  To be clear, The Windows folks can still create a VPN connection.  However, they cannot access the PLC on the other side.  This wasn't obvious when I last posted because we didn't have the correct login info for the PLC so none of us could get in.  Now, my VPN connection allows me to log in to the PLC.  The Windows VPN connection cannot see the PLC log in page.  Can anyone suggest some areas to check in the administration pages of the router to find the difference between the PPTP protocol which works and the QuickVPN protocol which doesn't?
    Mike

  • How to implement Failover in VPN Router

    Hi Everyone,
    I have got Cisco 3845 VPN router which is currently running in our network. We have purchased one more Cisco 3845 router as a standby for VPN router.
    I am planning to make the new router as a secondary router which should be connected on LIVE network. If primary router fails, secondary router should run automatically after certain period of time.
    When i was looking for such kind of solution i came across of Implementing FAILOVER and LOAD BALANCING method for such kind of scenerio. As i am new to this kind of method, so i would suggest some help from the experts out here.
    How do i implement Failover and Load Balancing with my TWO Cisco 3845 VPN router?
    Helping hands are highly appreciated...
    Thanks,
    TashiBDFCL                  

    hi ,
    Please refere below link to get things clear.....
    https://sites.google.com/site/amitsciscozone/home/security/load-balancing-with-2-isps
    thanks

  • Internet stops with PPTP VPN connections to ASUS RT-N66U VPN Router

    I have a client with a small office network that has a few people working remotely from Windows 7 and 8 PCs. As an inexpensive solution the client opted to use a VPN router (ASUS RT-N66U) that supports PPTP so remote users could access the shared
    files and SQL DB server. 
    The VPN connectivity for one client was working fine and then stopped working altogether so when the VPN connection is established all Internet and VPN access is stopped. This was especially troubling for me since I work remotely and cannot test or debug after
    the VPN session has been connected. I checked the error logs and found nothing. Also there had been no new programs installed. And finally, I ran a full system antivirus scan with no issues found.
    In case you are facing a similar issue, before trying something remotely that may not work, use the shutdown with reboot command in a COMMAND window and set a timer for something like 3 minutes to reboot in case you get stuck. (e.g. shutdown -r -t 180). 
    Problem: The two symptoms of the VPN connection failure are:
    1) All Internet browsing stops working locally 
    2) No data can pass through the VPN tunnel
    I created a virtual machine on my local network and replicated the client's environment. I experimented with nearly every setting in the VPN dialogue until and came to the final solution. 
    Solution: For the VPN adapter on the remote machines I configured DNS settings and used the remote as the default gateway.
    * VPN adapter Networking IPV4 Properties for:
    - DNS server 1: Main Office VPN Router IP Address
    - DNS server 2: A public DNS server (Google is 8.8.8.8)
    - I also checked the box to "register this connection addresses in DNS"
    Note: Perhaps the local router would also have worked and DNS2 but I didn't test it.
    I have documented this because after reading and searching among many Technical articles and the Microsoft support website, I was unable to find the solution that I came up with so I hope to help someone else. 
    Question1: - Can anyone tell me why the connectivity only works when 'use default gateway on remote network' is checked?
    - I have disabled this option with some business class VPN routers and the connectivity still worked to the remote network but it does not work to the Asus router.
    Question2: From the information provided can I determine where the problem lies?
    Is it the:
    1) Remote client PC
    2) Remote client router
    3) Home office VPN router (Asus RT-N66U)
    If the true culprit cannot be determined yet, what steps do you recommend so I can isolate the true cause of the failure.
    I appreciate any help so that I can be sure my solution is valid and pass along the findings to ASUS if it is their issue.

    Thank you for the suggestion. I have successfully connected through the VPN router when the one client was unable to get VPN throughput working.
    I looked at the routing tables with and without the VPN connection established. The differences are that:
    1) when VPN is NOT active, there is a route from the local NIC IP to the Internet IP address of the local gateway
    destination 68.109.82.xx
    mask 255.255.255.0
    gateway 192.168.0.1
    interface 192.168.0.11
    metric 21
    2) when VPN IS active, the route to the Internet IP address of the local gateway is deleted and a persistent route to the VPN router local network has been added
    Persistent route:
    destination 192.168.21.0
    mask 255.255.255.0
    gateway 192.168.0.1
    interface 192.168.0.11
    metric 1

  • Rt-filter or route-policy in a route-reflector

    Hi,
    I want to implement a route reflector that i will use in two differents networks with differents VPNL3. So i do not want that my route reflector advertise the prefixes form a network to the other. I am using an ASR9000 with IOS XR 4.3.2 as route reflector.
    I tried two differents configurations in a testing enviroment and both work fine, one applying route-policy filtering by RD, and another using RT-filter. But i do not know what is better to implement on production. I will appreciate if somebody could help me to decide what is the best to implement in a production Network, thinking in the resources of the network and in the IPv6 deployment (i could not configure RT Filter with address-family ipv6)
    With route-policy
    rd-set RD_XXX
    65000:*
    end-set
    route-policy to_XXX
    if rd in RD_XXX then
       pass
      else
       drop
      endif
    end-policy
    route-policy to_YYY
    if rd in RD_XXX then
      drop
    else
      pass
    endif
    end-policy
    router bgp 65001
    neighbor-group XXX
      remote-as 65001
    address-family vpnv4 unicast
      route-reflector-client
      route-policy to_XXX out
    neighbor-group YYY
       remote-as 650001
       update-source Loopback0
      address-family vpnv4 unicast
        route-reflector-client
        route-policy to_YYY out
    with RT-Filter
    router bgp 65001
    address-family ipv4 rt-filter
    neighbor-group XXX
      address-family ipv4 rt-filter
       route-reflector-client
       soft-reconfiguration inbound always
    neighbor-group YYY
      address-family ipv4 rt-filter
       route-reflector-client
       soft-reconfiguration inbound always
    Regards

    Hi,
    One benefit I see with rt-filter is, this feature provides considerable savings in CPU cycles and transient memory usage, generally this will be beneficial when you have large number of prefixes to be filtered, as you do not need to define route-policy for all the prefixes, and also it simple to configure (only one command )
    Look at the  Restrictions for BGP: RT Constrained Route Distribution in below document
    http://www.cisco.com/en/US/docs/ios/ios_xe/iproute_bgp/configuration/guide/irg_rt_filter_xe.html
    HTH
    Regards,
    Sandip

  • PIX 501 and Linksys VPN Router (WRV200)

    I have inherited a job where we have a Cisco PIX 501 firewall at one site, and Linksys WRV200 VPN Router on two other
    sites. I have been asked to connect these Linksys routers to the PIX firewall via VPN.
    I believe the Linksys vpn routers can only connect via IPSec VPN, so i am looking for help on configuring the PIX 501 to allow the linksys to connect with the following parameters, if possible.
    Key Exchange Method: Auto (IKE)
    Encryption: Auto, 3DES, AES128, AES192, AES256
    Authentication: MD5
    Pre-Shared Key: xxx
    PFS: Enabled/Disabled
    ISAKMP Key Lifetime: 28800
    IPSec Key Lifetime: 3600
    On the PIX i have the PDM installed and i have tried using the VPN Wizard to no avail.
    I chose the following settings when doing the VPN Wizard:
    Type of VPN: Remote Access VPN
    Interface: Outside
    Type of VPN Client Device used: Cisco VPN Client
    (can choose Cisco VPN 3000 Client, MS Windows Client using PPTP, MS Windows client using L2TP)
    VPN Client Group
    Group Name: RabyEstates
    Pre Shared Key: rabytest
    Extended Client Authentication: Disabled
    Address Pool
    Pool Name: VPN-LAN
    Range Start: 192.168.2.200
    Range End: 192.168.2.250
    DNS/WINS/Default Domain: None
    IKE Policy
    Encryption: 3DES
    Authentication: MD5
    DH Group: Group 2 (1024-bit)
    Transform Set
    Encryption: 3DES
    Authentication: MD5
    I have attached the VPN log from the Linksys VPN Router.
    This is the first time i've ever worked with PIX so i'm still trying to figure the thing out, but i'm confident with CCNA level networking.
    Thanks for your help!

    Hi again,
    I believe the pix has a 3des license because of the following parts of the "show version"
    Licensed Features:
    Failover: Disabled
    VPN-DES: Enabled
    VPN-3DES-AES: Enabled
    This PIX has a Restricted (R) license.
    I've tried reconnecting the VPN tunnel with debugging on the PIX and get the output as shown in the attached file "vpndebug.txt"
    As for the other show commands they give:
    pixfirewall# show crypto isakmp sa
    Total : 0
    Embryonic : 0
    dst src state pending created
    pixfirewall# show crypto ipsec sa
    interface: outside
    Crypto map tag: transam, local addr. 10.0.0.1
    local ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
    remote ident (addr/mask/prot/port): (192.168.101.0/255.255.255.0/0/0)
    current_peer: 10.0.0.2:0
    PERMIT, flags={origin_is_acl,}
    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest 0
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0
    local crypto endpt.: 10.0.0.1, remote crypto endpt.: 10.0.0.2
    path mtu 1500, ipsec overhead 0, media mtu 1500
    current outbound spi: 0
    inbound esp sas:
    inbound ah sas:
    inbound pcp sas:
    outbound esp sas:
    outbound ah sas:
    outbound pcp sas:
    pixfirewall#
    Thanks again Daniel, i really appreciate your help on this matter.

  • First time vpn router

                       First time with a vpn router and need advice getting everything running with my current vpn provider.
    router: 887vag vdsl2/adsl2+ POTS with 3g.
    question: Do i need to flash the router with dd-wrt?
    Are there any step by step guides you can give for this
    thnx

    Hi again,
    I believe the pix has a 3des license because of the following parts of the "show version"
    Licensed Features:
    Failover: Disabled
    VPN-DES: Enabled
    VPN-3DES-AES: Enabled
    This PIX has a Restricted (R) license.
    I've tried reconnecting the VPN tunnel with debugging on the PIX and get the output as shown in the attached file "vpndebug.txt"
    As for the other show commands they give:
    pixfirewall# show crypto isakmp sa
    Total : 0
    Embryonic : 0
    dst src state pending created
    pixfirewall# show crypto ipsec sa
    interface: outside
    Crypto map tag: transam, local addr. 10.0.0.1
    local ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
    remote ident (addr/mask/prot/port): (192.168.101.0/255.255.255.0/0/0)
    current_peer: 10.0.0.2:0
    PERMIT, flags={origin_is_acl,}
    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest 0
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0
    local crypto endpt.: 10.0.0.1, remote crypto endpt.: 10.0.0.2
    path mtu 1500, ipsec overhead 0, media mtu 1500
    current outbound spi: 0
    inbound esp sas:
    inbound ah sas:
    inbound pcp sas:
    outbound esp sas:
    outbound ah sas:
    outbound pcp sas:
    pixfirewall#
    Thanks again Daniel, i really appreciate your help on this matter.

  • MP-BGP and Route-Reflector

    Hi All...
    I have this topology:
    CE2-->PE1-->P--->PE2-->CE2
    .............\-->PE3-->CE2
    In router "P" I want to configure MP-BGP, but I have many doubts with configurations this router. I need to do route-reflector too.
    Anybody can help me?
    CLRGomes

    Thanks, look my configuration:
    Router P
    router bgp 65500
    no synchronization
    no bgp default route-target filter
    bgp log-neighbor-changes
    neighbor MPLS peer-group
    neighbor MPLS remote-as 65500
    neighbor MPLS ebgp-multihop 255
    neighbor MPLS update-source Loopback0
    neighbor MPLS route-reflector-client
    neighbor MPLS allowas-in
    neighbor MPLS soft-reconfiguration inbound
    neighbor 10.10.10.2 peer-group MPLS
    neighbor 10.10.10.3 peer-group MPLS
    neighbor 10.10.10.4 peer-group MPLS
    no auto-summary
    address-family vpnv4
    neighbor MPLS route-reflector-client
    neighbor MPLS send-community both
    neighbor 10.10.10.2 activate
    neighbor 10.10.10.3 activate
    neighbor 10.10.10.4 activate
    exit-address-family
    ok...working perfect, I did MP-BGP between PE routers and I configured RDs differents too...
    Later I did between PE->CE with OSPF and working too, loadshare working.
    Thanks a lot
    CLRGomes
    CCIE R&S

  • Inbound ACL for public VPN router

    Hi all,
    I have configured our VPN router for access for all our mobile clients. Our private VPN range is going to be 172.16.10.x/24. Do I need to add ACL permit rules for this range on our inbound ACL to all the inside LANs to facilitate access for the VPN users?
    eg int S0/0/0
         ip address 85.x.x.x
         ip access-group 100 in
    access-list 100 permit ip 172.16.10.0 0.0.0.255 192.168.1.0 0.0.0.255
    If I understand things correctly, once the user connects, the VPN is tunnelled as far as the inside of the interface, so traffic passing through the VPN is encapsulated and hence wouldnt appear as a private IP?
    All comments are greatly appreciated.
    Paul

    Sorry  I mean to say you should not edit outside acl for vpn traffic for rest of the things you can do it.
    Thanks
    Ajay

  • RV042 not annoucing vpn routes over rip v2

    Problem: RV042 is not announcing a class C VPN route via RIP to other routers. It announces the gateway public address via rip, but not the VPN route.
    I am attempting to use a pair of RV042 as a redundant links between our home office and a branch. The home office and branch is already connected via a T1. Each location also has an additional cable internet connection with public IP address and a cisco 1921 router controlling the traffic.
    The 1921 routers are using OSPF to route traffic over the T1 and have RIPv2 enabled to talk to their local respective RV042s. Here is a description of how the network is set up.
    MainRouter - cisco 1921
       Eth0 - Network is 192.168.41.0/24
                 IP address is 192.168.41.20
       Eth0/1 - Network 10.1.1.1 255.255.255.254
                T1 connection to branch router
    MainRV - RV042 v3 with fw 4.2.1.02
       Wan1 - Public IP A X.X.X.X
        LAN- Network 192.168.41.0/24
                  IP 192.168.41.11 255.255.255.0
    BranchRouter - cisco 1921
      Eth0/0 - Network is 192.168.46.0/24
                   IP address is 192.168.46.10
      Eth0/1 - Network 10.1.1.2 255.255.255.254
                T1 connection to main router
    BranchRV - RV042 v3 with fw 4.2.1.02
      Wan1 - Public IP B Y.Y.Y.Y
        LAN - Network 192.168.46.0/24
                  IP 192.168.46.11 255.255.255.0
    I have established a VPN from BranchRV to MainRV and it passes traffic correctly. My "MainRouter "
    rip database looks like this....
    192.168.41.0/24    auto-summary
    192.168.41.0/24    directly connected, GigabitEthernet0/0
    X.X.X.X/24    auto-summary
    X.X.X.Z/30
        [1] via 192.168.46.11, 00:00:01, GigabitEthernet0/0
    Notice that there is no route to 192.168.46.0/24 in there....
    Now here is the kicker, just messing around, I changed the VPN settings to use subnets 10.0.10.0/24 on MainRV and 10.0.11.0/24 on BranchRV instead of 192.168.41.0/24 and 192.168.46.0/24 respectivly. After I tried that the routes for the 10.0.3.0 were announced via RIP
    Here is what the MainRouter's rip database looked like after I tried that
    10.0.0.0/8    auto-summary
    10.0.11.0/24
        [2] via 192.168.41.11, 00:00:18, GigabitEthernet0/0
    192.168.41.0/24    auto-summary
    192.168.41.0/24    directly connected, GigabitEthernet0/0
    X.X.X.X/24    auto-summary
    X.X.X.Y/30
        [1] via 192.168.41.11, 00:00:18, GigabitEthernet0/0
    What gives? This really looks like a bug to me...
    Anyhow I'm thinking a workaround might be to set up a GRE tunnel across those 10.0.X.X subnets to the other side so I can at least dynamically route traffic accross.... Without the RIP routes being announced I don't have automatic failover!
    Thanks for your help,
       Curtis

    Yes as was explained to me previously.... by Jason Nickle multicast does not cross a site-to-site tunnel.
    That is not what I want to have happen. What I want is for my RV042 to announce it's VPN routes to other routers on the same physical network. Which it currently is not doing.
    Site 1
        Cisco IOS Router X - main router, local network traffic runs across this
         RVO42 X - has VPN link to RVO42 Y at Site 2
    Site 2
      Cisco IOS Router Y - main router, local newtok traffic runs acress this
       RVO42 Y - has VPN link to RVO42 X at Site 1
    The problem is that RV042 Y doesn't tell Router Y that it has a route to Site 1. And RV042 X doesn't tell Router X that it has a route to Site 2. So they are not locally announcing via RIP, the routes they have TO the respective remote sites.
    What I was trying to say in my original post, is that the router will announce VPN routes if the vpn subnets are a class A 10.X.X.X subnet, but it doesn't announce them if they are a class C 192.168.X.X subnet. So what I am doing should be working, however it is not.

Maybe you are looking for