Syn Timeout Traffic From VPNPool
Hello i know theres a lot topics about the subject but i been reading since past 2 weeks and i cant find my solution.
My VPN Cisco client connects to the ASA 5510 and everything looks good but when i try send traffic(RDP) nevers connects and the logs shows a syn timeout. Here is my Configuration i really appreciated any help
ASA Version 8.2(1)
hostname xxx
domain-name xxxx
enable password g.wfzl577L4IVnRL encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
interface Ethernet0/0
nameif outside
security-level 0
ip address 201.199.135.x 255.255.255.248
interface Ethernet0/1
nameif inside
security-level 100
ip address 10.1.1.x 255.255.255.0
interface Ethernet0/2
no nameif
security-level 100
ip address 192.168.30.x 255.255.255.0
interface Ethernet0/3
shutdown
no nameif
no security-level
no ip address
interface Management0/0
nameif management
security-level 100
ip address 192.168.1.1 255.255.255.0
management-only
boot system disk0:/asa821-k8.bin
ftp mode passive
dns domain-lookup outside
dns server-group DefaultDNS
name-server xx
name-server xx
domain-name xxxxx
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
access-list inbound extended deny ip object-group Deny_Access any
access-list inbound extended permit tcp any object-group web-servers object-group web-ports
access-list inbound extended permit tcp 209.200.128.0 255.255.192.0 host 201.199.135.x object-group web-ports
access-list outbound extended permit ip object-group trusted any
access-list outbound extended permit tcp object-group web-servers any object-group web-ports
access-list outbound extended permit tcp 10.1.1.0 255.255.255.0 any object-group general-access
access-list outbound extended permit tcp host 201.199.135.xx any object-group web-ports
access-list inside_access_in extended permit ip object-group trusted any log disable
access-list inside_access_in extended permit ip object-group DNS-Servers any log disable
access-list inside_access_in extended permit udp host WEB3 any eq ntp inactive
access-list inside_access_in extended permit ip 192.168.3.0 255.255.255.0 10.1.1.0 255.255.255.0
access-list ISA_access_in extended permit object-group Ports host 192.168.30.7 any
access-list inside_nat0_outbound extended permit ip 10.1.1.0 255.255.255.0 192.168.3.0 255.255.255.0
access-list Split_Tunnel_List standard permit 10.1.1.0 255.255.255.0
pager lines 24
logging enable
logging list configLog level debugging class auth
logging list configLog level debugging class config
logging list system-IDSLog level informational class ids
logging list system-IDSLog level informational class sys
logging buffer-size 10000
logging asdm informational
logging from-address xxxx
logging recipient-address xxxxx level notifications
no logging message 111008
no logging message 111007
mtu outside 1500
mtu inside 1500
mtu ISA 1500
mtu management 1500
ip local pool VPN-POOL 192.168.3.2-192.168.3.254 mask 255.255.255.0
ip audit name attackPolicy attack action alarm drop
ip audit name antiSnifferPolicy info action drop
ip audit interface outside attackPolicy
no failover
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-641.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
global (ISA) 1 201.199.135.xx netmask 255.255.255.248
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 10.1.1.0 255.255.255.0
nat (ISA) 1 192.168.30.0 255.255.255.0
static (inside,outside) 201.199.xxx.xx WEB3 netmask 255.255.255.255
access-group inside_access_in in interface inside
access-group ISA_access_in in interface ISA
route outside 0.0.0.0 0.0.0.0 201.199.135.113 1
route inside 0.0.0.0 0.0.0.0 10.1.1.3 tunneled
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication ssh console LOCAL
aaa authentication serial console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 management
http 10.1.1.0 255.255.255.0 inside
snmp-server host inside 10.1.1.56 community
snmp-server host inside 10.1.1.18 community
no snmp-server location
no snmp-server contact
snmp-server community *****
snmp-server enable traps snmp authentication linkup linkdown coldstart
snmp-server enable traps syslog
service resetinbound interface ISA
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto ca trustpoint ASDM_TrustPoint0
enrollment self
subject-name CN=xxx.xxxxxx
keypair sslvpnkeypair
crl configure
crypto ca certificate chain ASDM_TrustPoint0
certificate 6ef8fc4f
308201f3 3082015c a0030201 0202046e f8fc4f30 0d06092a 864886f7 0d010105
0500303e 311a3018 06035504 03131149 4345332e 646f746e 65742e63 6f2e6372
3120301e 06092a86 4886f70d 01090216 11494345 332e646f 746e6574 2e636f2e
6372301e 170d3132 30393035 31333435 35345a17 0d323230 39303331 33343535
345a303e 311a3018 06035504 03131149 4345332e 646f746e 65742e63 6f2e6372
3120301e 06092a86 4886f70d 01090216 11494345 332e646f 746e6574 2e636f2e
63723081 9f300d06 092a8648 86f70d01 01010500 03818d00 30818902 818100e4
52687fe4 bc46d95c bb14cb51 c9ba2757 692683e2 315fb2cb 585c9785 295e9090
88dea89d 5a1497f5 49107a1f ea35d71b fd05d9ff 68766519 652f1ff9 d19dc584
310312b2 b369673f 70db355a 8d1e0a5e 4c825c27 7ad5e4f6 d36cbda7 b4ad77a5
f490d942 2ef2488a bcb97b3f 5795bbcd 5f5b5c5a ff965272 2c8deaa5 2aa78902
03010001 300d0609 2a864886 f70d0101 05050003 818100aa c1a3301a ec3898ac
18699233 9aa26005 ad6c326f 51228c6b ba6a91e8 2ac79a0c 2af687c1 17bce83f
bbf94b0e e6f09977 fad72c47 96d206ed c1157e67 79862e20 9f28cfa1 739c0fa2
81272d5d a7124fc0 f95904db 72eacc9a 772208e2 1edba72b 618ed8dc d3c1b8f7
5047604e f767eaf1 7ee5ed95 79ef9184 db62bcfb b71e6f
quit
no vpn-addr-assign aaa
no vpn-addr-assign dhcp
telnet timeout 5
ssh 10.1.1.0 255.255.255.0 inside
ssh timeout 5
ssh version 2
console timeout 0
dhcpd address 192.168.30.5-192.168.30.20 ISA
dhcpd dns 4.2.2.2 200.91.75.5 interface ISA
dhcpd enable ISA
dhcpd address 192.168.1.2-192.168.1.254 management
dhcpd enable management
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ssl trust-point ASDM_TrustPoint0 outside
webvpn
enable outside
enable inside
svc image disk0:/anyconnect-win-2.5.2019-k9.pkg 1
svc enable
tunnel-group-list enable
group-policy DfltGrpPolicy attributes
vpn-tunnel-protocol IPSec l2tp-ipsec
group-policy VPNGP internal
group-policy VPNGP attributes
wins-server none
dns-server value 10.1.1.11 10.1.1.16
vpn-tunnel-protocol svc webvpn
split-tunnel-policy tunnelspecified
split-tunnel-network-list value Split_Tunnel_List
default-domain value dotnet.co.cr
address-pools value VPN-POOL
username xxxx password gsUajqpee0ffkhsw encrypted
username xx password Wl5xhq9rOjTEyzHN encrypted privilege 15
username xxvpn password 9tblNqPJ2.cWaLSD encrypted
username xxvpn attributes
service-type remote-access
tunnel-group AnyConnect type remote-access
tunnel-group AnyConnect general-attributes
default-group-policy VPNGP
tunnel-group AnyConnect webvpn-attributes
group-alias VPN enable
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
policy-map type inspect dns migrated_dns_map_1
parameters
message-length maximum 512
service-policy global_policy global
smtp-server 10.1.1.20
prompt hostname context
Cryptochecksum:9720306792f52eac533976d69f0f3daa
: end
Thanks
Hi Oscar,
The configuration seems to be fine.
At this point lets troubleshoot the VPN communication.
The SYN timeout means that the server does not repond, or the SYN ACK never reached the ASA.
We need to place a packet capture on the inside interface as follows:
capture capin interface inside match ip 10.1.1.0 255.255.255.0 192.168.3.0 255.255.255.0
Then you try to access the server via RDP and issue the "show capture capin" command.
Another good test would be the following:
packet-tracer input inside icmp 10.1.1.250 8 0 192.168.3.1 detail ---> where the 192.168.3.1 must be the IP of the VPN client
Attach the output of the "show capture capin" and "packet-tracer" output.
Let me know.
Portu.
Please rate any post you find useful.
Similar Messages
-
SYN timeout connecting to a server through the VPN
Hello,
I have a very odd problem. When connected to the VPN, I can connect to all my servers without problem on any services. On a single server, when I try to connect to Windows shares, it doesn't work. My event log shows nothing on the client or on the server but I get this from the ASA:
10-20-2008 20:54:45 Local4.Info 192.168.1.1 %ASA-6-302014: Teardown TCP connection 288013 for outside:192.168.2.1/1566 to inside:192.168.1.9/445 duration 0:00:30 bytes 0 SYN Timeout (user)
At home I'm on 192.168.50.xx, the lan at work is 192.168.1.xx and the VPN range is 192.168.2.xx.
Any ideas?
ERHello ER,
Thanks for the confirmation. If everything is configured correctly and the issue is only across the VPN Tunnel, your symptoms closely match Bug ID CSCsf23145.
Please refer the release notes for details:
http://www.cisco.com/en/US/docs/security/asa/asa72/release/notes/asarn722.html
CSCsf23145
Unable to complete large uploads through VPN if packet loss occurs
Please use the below URL to look up the bug id and the version that has the fix.
http://tools.cisco.com/Support/BugToolKit/action.do?hdnAction=searchBugs
let me know if it helps.
Regards,
Arul
** Please rate all helpful posts ** -
Unable to allow traffic from remote office - Cisco RV220W
Hi there,
I have just bought the RV220W Cisco router firewall because my DLINK-1600 got broken and now I am unable to allow access to the machines located behind this router from the machines located at a remote office. Any help would be much appreciated!!
This is the situation:
1. Two remote offices A and B connected by a VPN tunnel (this connection is managed by an external provider and it is properly functioning)
2. IP range A office: 192.168.236.0/24
3. IP range B office: 192.168.237.0/24
4. Office A: CISCO RV220W router/firewall (the one that I´ve just bought as the old dlink has broken). This RV220W is connected to a cisco router (managed by provider) that is the one with the VPN tunnel to the other office. The CISCO router does not do NAT. On the other end (Office B) there is another CISCO router managed by the provider.
5. Everything was working smoothly until our old router/firewall got broken and that is when I bought the rv220w. I have set up the CISCO RV220W at office A and the machines can ping the machines located at office B and can browse the internet, i.e., the traffic going out is OK and in that sense everything works smoothly.
6. The problem is that the machines located at office B cannot access the machines located behind the CISCO RV220W and I know it is a problem of the firewall as if I capture traffic coming from office B, I can see that it is dropped by the CISCO RV220W.
7. I have tried to enable an access rule in the firewall to allow traffic from office B (see picture below) but it does not seem to work. In the field, Send to Local Server (DNAT IP) I have entered the WAN IP of my router (you cannot leave it blank) … this rule does not work at all. I think that is not properly configured but I don´t know how to do it.
8. As you see, the problem is that I don´t know how to set up a rule to allow specific traffic coming from the WAN (traffic from remote office – 192.168.237.0/24) to the LAN at office A - 192.168.236.0/24.
In the old router/firewall I just had to create a rule specifying the source interface (WAN) and network (Office B) and the destination interdace (LANOfficeA) and network (Office A). It does not seem that here I can do the same. i mean, you always have to point to a server ip inside the LAN??
I know it has to be a very easy thing to do but at this moment I am completely stuck. If anyone can give me some advice would be great.
Thanks a lot for your help in advanced!
EvaHi Eva, the default inbound policy cannot be changed. It will block all inbound traffic. To my knowledge there is not a way around this. Access rules are the only way to 'poke' a hole through the firewall but as you note, it is for a specific host. Values such as .0 and .255 do not work.
-Tom
Please mark answered for helpful posts -
Permit traffic from Inside to Outside, but not Inside to medium security interface
Can someone just clarify the following. Assume ASA with interfaces as :
inside (100) (private ip range 1)
guest (50) (private ip range 2)
outside (0) (internet)
Example requirement is host on inside has http access to host on outside, but it shouldn’t have http access to host on guest – or any future created interfaces (with security between 1-99).
What’s the best practice way to achieve this?Hi,
The "security-level" alone is ok when you have a very simple setup.
I would suggest creating ACLs for each interface and use them to control the traffic rather than using the "security-level" alone for that.
If you want to control traffic from "inside" to any other interfaces (and its networks) I would suggest the following
Create and "object-group" containing all of the other network
Create an ACL for the "inside" interface
First block all traffic to other networks using the "object-group" created
After this allow all rest of the traffic
In the case where you need to allow some traffic to the other networks, insert the rule at the top of the ACL before the rule that blocks all traffic to other networks
For example a situation where you have interfaces and networks
WAN
LAN-1 = 10.10.10.0/24
LAN-2 = 10.10.20.0/24
DMZ = 192.168.10.0/24
GUEST = 192.168.100.0/24
You could block all traffic from "LAN-1" to any network other than those behind the "WAN" interface with the following configuration.
object-group network BLOCKED-NETWORKS
network-object 10.10.20.0 255.255.255.0
network-object 192.168.10.0 255.255.255.0
network-object 192.168.100.0 255.255.255.0
access-list LAN-1-IN remark Block Traffic to Other Local Networks
access-list LAN-1-IN deny ip any object-group BLOCKED-NETWORKS
access-list LAN-1-IN remark Allow All Other Traffic
access-list LAN-1-IN permit ip 10.10.10.0 255.255.255.0 any
This should work if your only need is to control the traffic of the interface "LAN-1". If you want to control each interfaces connections to the others then you could do minor additions
Have all your local networks configured under the "object-group"This way you can use the same "object-group" for each interface ACL
object-group network BLOCKED-NETWORKS
network-object 10.10.10.0 255.255.255.0
network-object 10.10.20.0 255.255.255.0
network-object 192.168.10.0 255.255.255.0
network-object 192.168.100.0 255.255.255.0
access-list LAN-1-IN remark Block Traffic to Other Local Networks
access-list LAN-1-IN deny ip any object-group BLOCKED-NETWORKS
access-list LAN-1-IN remark Allow All Other Traffic
access-list LAN-1-IN permit ip 10.10.10.0 255.255.255.0 any
access-list LAN-2-IN remark Block Traffic to Other Local Networks
access-list LAN-2-IN deny ip any object-group BLOCKED-NETWORKS
access-list LAN-2-IN remark Allow All Other Traffic
access-list LAN-2-IN permit ip 10.10.20.0 255.255.255.0 any
access-list DMZ-IN remark Block Traffic to Other Local Networks
access-list DMZ-IN deny ip any object-group BLOCKED-NETWORKS
access-list DMZ-IN remark Allow All Other Traffic
access-list DMZ-IN permit ip 192.168.10.0 255.255.255.0 any
access-list GUEST-IN remark Block Traffic to Other Local Networks
access-list GUEST-IN deny ip any object-group BLOCKED-NETWORKS
access-list GUEST-IN remark Allow All Other Traffic
access-list GUEST-IN permit ip 192.168.100.0 255.255.255.0 any
Then you could basically use the same type ACLs in each interface. (Though still separate ACLs for each interface) And as I said if you need to open something between local networks then insert the correct "permit" tule at the top of the ACL.
Hope this helps
- Jouni -
How can i configure my iphone to only pass traffic from certain apps over vpn
I have got a telephony app that connects to a phone system through vpn. when I turn on "send all traffic through vpn" internet and other apps are really slow. is their a way to configure the phone to send only traffic from the app through VPN.
Now all my new apps as well as several others are gone from the iPhone.
Look on other screens. The 4.1 update ands Game Center to the home screen. If that screen was full it create a blank screen and moves one app from the home screen to the new screen to make room for Game Center. All the other screens are pushed back one place.
How can I get my apps back? It cost me a lot of time and money to discover those apps and get them onto the phone. Are they just gone now?
If they are really gone, you can download them again. You will not be charged again if you use the same iTunes account. -
Possible to allow any traffic from a certain IP?
Basic question:
I'm using Snow Leopard and want to be able to allow any incoming traffic from a certain IP. I'm not concerned about what ports because it's a local device (PS3) behind the router. Is there a way to accomplish this without resorting to ipfw?
Additional info:
I have tried to add the PS3 Media Server program to the firewall list but even though it's set to allow, the firewall blocks incoming connections for it. I confirmed this through the console logs. I think it's something to do with being a Java based program.
Console:
8/29/09 3:37:59 PM 0x0-0x85085.PS3 Media Server1106 main TRACE 15:37:59.547 Created socket: /10.0.1.2:5001
8/29/09 3:37:59 PM Firewall1028 JavaApplicationS is listening from 10.0.1.2:5001 proto=6
8/29/09 3:38:04 PM Firewall1028 Deny JavaApplicationS connecting from 10.0.1.3:50680 to port 5001 proto=6Don't know anything about the topic, but this might help.
http://forums.macrumors.com/showthread.php?t=774875 -
For my Rapid Video Blogging I would like to bring the traffic from You Tube
I hear there are sites as complicated and financially up there, Blogcasts, and all kind of sites that I could try to get involved with to have a place where I can try to get the traffic from watching the Video Rapid Blogs. I am not sure of the technology, from simple sites to a full on website. Does anybody have this knowledge so I could get going on getting this set up. I would need some site to bring the traffic to where what I am selling is and hopefully have a good response.
I am brand new at all of this but I have the academic and practical knowledge-working for years in teaching at the college level in exercise physiology, have gone on to get my registered dietician degree so I left school when I was done, put a small studio together where I worked mostly with memdical doctor's referrals since I had been around the rehab docs during my rotation for my exercise physiology degree.
I love the studio, but all my bad technique when I was young and my sport injuries all hit at once. I developed brain CA, had some chemo and radiation. I had to close the studio but I still have to live so I am thinking this rapid video blogging, put out some 3 minute video blogs supporting my ability to help some people who tried all kinds of weight loss methods, work with the tried and true wy but add the psych in that which can help them not expect quick-fixes, not support nutrition bars that do not fit in until they are egged in a exercise program, get rid of all the stuff 24 hour fitness tries to sell them unless they want to know how many steps they take. I could put some 3-4 minute video blogs together bringing the potential customers back to my website or whatever kind of site i would need. i m not up-to-date on all the various site for stuff like this, but if anybody want s to help e get an awareness of what is out there available to me, I would appreciate if anybody has the knowledge and practice in these areas of websites, blog sites, to help me put some classy, straight to-the-pont video info together, I would really appreciate it. I keep reading about blog spots,mad a;; types of things like websites where iI could push the traffic fro You Tube bak to this site for some sales.I dont understand anything you said in your post.
Do you have a specific question about video production?
The forums are for individual technical or creative issues that users have with video production. I am sur someone will be able to help you, but and to get a response it is best to ask a specific question.
Is this about a technical problem you have or something about setting up a web site? If its the latter this is the wrong forum. -
Does WCCP support traffic from different VLANs(mapped to VRFs)?
Hello,
I have the following scenario from the WAN to the Data Center and from the WAN to the Branch:
1. Router 2800/7200 with three (3) MPLS VRFs (VRF Lite)
2. Switch 3750 with three (3) WAN VLANs (one for each VRF) and three (3) LAN User Traffic VLANs (one for each ASA Context) and one WAE VLAN
3. WAE with WCCP enabled for one VLAN in the switch
4. ASA with three (3) Contexts
5. Three (3) Internal LANs (one for each Context)
In summary, there are three flows of traffic which are separated along the way from Branch to Data Center. WAEs are working for one VLAN(VRF1) and WCCP is enabled at the 3750 Switch to do the redirection (not in the router). The question is: does WCCP support traffic from different VLANs (similar to inline 802.1Q) and handle all three flows separate? If so, what should the configuration be at the switch and the WAE?
Thanks.The VRF awareness for 12.4(T) is still probably 8-12 months out. VRF aware WCCP features are definitely in the pipeline, but nothing has been publically published on availability timelines.
It's now publically available on the forum... but , I've only found it on the 3750 and 3550 documentation.
at the 3750 you will need to place the redirect statement on each of the VLANs, ip wccp 61 redirect in
Kindly find here GRE Tunnel with VRF Configuration Example:
http://www.cisco.com/en/US/tech/tk436/tk428/technologies_configuration_example09186a00801e1294.shtml
I have gotten as far as the WAE registering the router:
"WCCP configuration for TCP Promiscuous service 61 and 62 succeeded.
WCCP configuration for TCP Promiscuous succeeded.Please remember to
configure WCCP service 61 and 62 on the corresponding router."
wae01#sh wccp router
Router Information for Service: TCP Promiscuous 61
Routers Configured and Seeing this Wide Area Engine(1)
Router Id Sent To Recv ID
0.0.0.0 209.1.1.1 0000022F
The router registers the WAE as a WCCP client:
router04#
"*Feb 4 18:56:09.892: %WCCP-5-SERVICEFOUND: Service 61 acquired on WCCP
client 209.1.1.2"
"*Feb 4 18:56:09.892: %WCCP-5-SERVICEFOUND: Service 62 acquired on WCCP
client 209.1.1.2"
The router however cannot figure out what its ID is and does not see
itself as a WCCP group router.
router04#sh ip wccp
Global WCCP information:
Router information:
Router Identifier: -not yet determined-
Protocol Version: 2.0
Service Identifier: 61
Number of Service Group Clients: 1
Number of Service Group Routers: 0
Total Packets s/w Redirected: 0
Process: 0
Fast: 0
CEF: 0
Redirect access-list: ACCELERATED-TRAFFIC
Total Packets Denied Redirect: 0
Total Packets Unassigned: 25957
Group access-list: -none-
Total Messages Denied to Group: 0
Total Authentication failures: 0
Total Bypassed Packets Received: 0
This is a short summary of important commands for working with VRF's.
View the VRF instances and the associated interfaces.
ml-mr-c6-gs#show ip vrf
Name Default RD Interfaces
blurvrf 100:2 Vlan215
Vlan326
tgvrf 100:1 Vlan132
Vlan325
TenGigabitEthernet1/1
ml-mr-c6-gs#
Show the routing table for a specific VRF.
ml-mr-c6-gs#show ip route vrf tgvrf
Routing Table: tgvrf
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external,
---More--
Gateway of last resort is 128.117.243.57 to network 0.0.0.0
O E2 192.52.106.0/24 [110/1] via 128.117.243.57, 1d19h, Vlan325
O E2 192.168.150.0/24 [110/160] via 128.117.243.57, 1d19h, Vlan325
172.17.0.0/29 is subnetted, 3 subnets
O E2 172.17.1.16 [110/0] via 128.117.243.57, 1d19h, Vlan325
O E2 172.17.1.8 [110/1] via 128.117.243.57, 1d19h, Vlan325
O E2 172.17.1.0 [110/1] via 128.117.243.57, 1d19h, Vlan325
--More--
Debugging should otherwise be similar to a regular switch or router.
Final Teragrid VRF Design and Diagrams
http://www.cisl.ucar.edu/nets/devices/routers/cisco/vrf/final.shtml
Teragrid Testbed Design
http://www.cisl.ucar.edu/nets/devices/routers/cisco/vrf/testbed.shtml
Cisco 4500 Series Switch Cisco IOS s/w config guide 12.1(20)EW
Configuring VRF-Lite
http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.1/20ew/configuration/guide/vrf.html
sachin garg -
VRF-Lite on one 6509; How to route traffic from global to VRF.
To anyone that can lead me in the right direction:
I have a 6509 switch with IOS " s3223-adventerprise_wan-mz.122-33.SXJ2.bin" on it. I am running VRF-lite on it and would like to route some subnets from the global route table to the VRF route table. How can I do this and stay on the same physical switch. I am using EIGRP for the global network and route table and static routing within the the VRF. Any suggestions or recommendations? Thanks in advance for your help in this matter...Hello,
You need to use (Static route) in both directions, One Static in the VRF table points to the Global interface, and another one in the Global point to the VRF interface for the recieved traffic. After that, you Can Redistribute the Global Static route into Eigrp for end-to-end connectivity!
Example:
Consider you have 2 interfaces in your Core SW-6509: One is G0/1 and the other is G0/2
G0/1 is placed into the Global table , and G0/2 is part of VRF (X)
interface G0/1
IP address 1.1.1.1 255.255.255.0
inteface G0/2
ip vrf forwarding X
ip address 2.2.2.2 255.255.255.0
Consider Subnet Y.Y.Y.Y in the Global and you want to have it accessible from the VRF!
configure this: (ip route vrf X y.y.y.y y.y.y.y.y G0/1 Global)
Configure also this for the return traffic from the Global table: (ip route 2.2.2.2 z.z.z.z G0/2)
You Can then redistribute the Global static into the Eigrp as below:
router Eigrp 1
no auto summary
redistribute static metric 1.1.1.1.1
HTH
Mohamed -
(AVC) Is there Any way to prioritize traffic from wireless client (laptop in my case) to AP
Is there any way to prioritize traffic from wireless client (laptop in my case) to AP …. if i explain the issue in a broad way there is no congestion going on in wired network. When multiple users connect to real presence and all share the same AP. they get real-time output over the call BUT if someone start file-transfer over the same AP the real presence call voice/video get stuck.
I applied the AVC feature on WLC but as i tested, i think prioritization from my laptop to AP will not happen and the situation remains same.
Please share if there is any way to prioritize traffic from wireless client (Laptop) to AP only ?Hi Vinod,
Here is the AVC & QoS interaction for upstream & downstream traffic. For downstream it is important you have configured your WLAN with correct QoS profile & 802.1p values as that play a role even though you marking traffic using AVC.
Upstream1. Packet comes with or without inner DSCP from wireless side (wireless client).2. AP will add DSCP in the CAPWAP header that is configured on WLAN (QoS based config).3. WLC will remove CAPWAP header.4. AVC module on the controller will overwrite the DSCP to the configured marked value in the AVC profile and send it out.Downstream 1. Packet comes from switch with or without inner DSCP wired side value.2. AVC module will overwrite the inner DSCP value.3. Controller will compare WLAN QoS configuration (as per 802.1p value that is actually 802.11e) with inner DSCP value that NBAR had overwritten. WLC will choose the lesser value and put it into CAPWAP header for DSCP.4. WLC will send out the packet to AP with QoS WLAN setting on the outer CAPWAP and AVC inner DSCP setting.5. AP strips the CAPWAP header and sends the packet on air with AVC DSCP setting; if AVC was not applied to an application then that application will adopt the QoS setting of the WLAN.
I am not sure which controller software version you are running. From AVC perspective, it is good if you could install latest NBAR protocol pack (4.1 for WLC 7.5.x code or 6.3 for WLC 7.6.x code) on your controller.
Here is the 7.5.x AVC deployment guide which should help you on this
http://www.cisco.com/en/US/docs/wireless/controller/technotes/7.5/AVC_dg7point5.html
Like others mentioned, it is very little you can do with respect to upstream direction as AVC kicks in only when traffic hits WLC & not at the AP level.
HTH
Rasika
**** Pls rate all useful responses **** -
Storage 7410 cluster - separating "admin" traffic from "storage" traffic
Please help me figure out a strategy here. We have a Storage 7410 cluster running in an active/passive mode. On each node, I have cabled nge0 and nge1 each to 100Mbps ports and nxge0 and nxge1 to 10Gbps ports. I have configured nge0 to be the "admin" interface for node 1, and nge1 the same for node 2. I have aggregated nxge0 and nxge1 via LACP and it's currently owned by node 1 (fails over to node 2 nicely). Here's the basic layout:
Node 1
nge0 -> active "admin" interface -> ip address 172.16.158.33
nge1 -> inactive (owned by Node 2) "admin" interface
nxge0/nxge -> active LACP aggregate "aggr1" -> ip address 172.16.158.32
Node 2
nge0 -> inactive (owned by Node 1) "admin" interface
nge1 -> active "admin" interface -> ip address 172.16.158.41
nxge0/nxge -> inactive (owned by Node 1) LACP aggregate
What's confusing me is routing. Right now all interfaces have IPs on the same subnet. I can define a default route for the gateway on that subnet (172.16.158.1) on the "aggr1" LACP, but only Node 1 gets routed. So, I can add two additional default routes to the same gateway, reflecting each of the other NICs (nge0, nge1). But the way I understand it, there's no guarantee that IP traffic that originated on aggr1 will return via that same interface. Or am I mistaken? Essentially, I want to segregate "storage" traffic from "admin" traffic, and I want to make sure that any host connecting to the "storage" IP address takes full advantage of the 10Gbps aggregate.
Any ideas are welcome.
CharlesMy assumption above was correct. At some point, traffic was now favored over nge0, so my performance went down from ~200MB/s to about 60MB/s (expected results with Windows VMs on vmware with a NFS datastore). It looks like I may have to abandon the nge ports and lose the LACP (at least until I can get a second nxge NIC in each head). Is that all I can do? Any ideas are appreciated.
Charles -
Best way of spanning traffic from ports to remote DC's N7Ks
Hello Team,
I have a site where many voice gateways are going to be located with ISDN30's in place. We need to span the traffic from these ports/vlan to remote DC's (to DC1 and DC2) to a particular VLAN or port (worst case scenario). The remote location consists of 4506E in VSS [the VG's will connect in to here] with 2 ASR 1002x's for WAN with 1 gb point to point links to DC1 and DC2.
In DC1 and DC2 are N7K's - from where the point to point come in to WAN VDC, the traffic needs to go to the LAN VDC to a VM. The LAN and WAN vdc's have L3 connectivity (OSPF)
What are the best ways of doing this...? I was starting to think OTV, however this may not work when spanning to a vlan - I haven't tried - will this work. Of course the solution will have to have resilience so spanning traffic to both DC1 and 2. I have done pseudo-wire before in another setup to accomplish this however this is different in that we may need to span to a vlan.
Thank you
BilalHello, I had already looked in to this, unfortunately won't work, since the requirement is to span to a vlan destination. We end up using dedicated expensive ports for erspan and other solutions so we've decided to keep the recording servers locally at site and every so often FTP to the DC.
Thanks for replying though -
Event 6-303014 Syn TimeOut when trying to access a page on Internet
Hello. I have a ASA 5540 (8.4) as an Internet Firewall.
When trying to navigate on Internet through ASA I can do it without problem except one page.
Page is accessible if I navigate without ASA Firewall (for example home Internet)
Reviewing firewall logs, event 6-303014 Syn TimeOut appears everytime I Try to access it.
This page works on port 80.
Thank you in advance for your advice.
Regards
FernandoDo you see a "3G", "E", or "o" next to the carrier name and signal indicator on the phone? If not, then you are not connected to a cellular data network at all. It's not impossible that you're not in range of their data network. Who is your carrier and where are you located?
If you do see one of those, you may want to call them again and ask explicitly to have them check the provisioning on your account. Just because it looks right in the billing system does NOT mean they have it set up correctly. -
Debugging HTTP traffic from iPad with Charles
Here's a great tip on how to use Charles on your Mac or PC to proxy HTTP traffic from your iPad so you can debug it.
http://www.ravelrumba.com/blog/ipad-http-debugging/Talking of debugging iPad, and Flash apps specifically, I only recently tried out the "Quick publishing for device debugging" option. When you do that, and run the app on the device, you can set Flash to be in a remote debugging session, and on the app screen you type in the IP address of your computer. You can then debug the running app in just the same way you would debug a swf running in your desktop browser. You don't even have to be connected by USB, it works across the wireless network.
-
Stop DHCP traffic from passing across interfaces
I'm having an issue with dhcp traffic passing across my cisco ASA 5510 interfaces.
Example of setup
Company 1 connected to interface 1 has its own dhcp server
Company 2 connected to interface 2 has its own dhcp server.
Some users are getting there ip address from the other companys dhcp server. The 2 companys should pass traffic to each other but not dhcp.
Is there anyway to stop dhcp traffic from crossing interfaces
Shaneusually have to permit DHCP traffic explicitly. Specification of the DHCP client-server protocol describes several cases when packets must have the source address of 0x00000000 or the destination address of 0xffffffff. Anti-spoofing policy rules and tight inclusive firewalls often stop such packets. Multi-homed DHCP servers require special consideration and further complicate configuration.
To allow DHCP, network administrators need to allow several types of packets through the server-side firewall. All DHCP packets travel as UDP datagrams; all client-sent packets have source port 68 and destination port 67; all server-sent packets have source port 67 and destination port 68. For example, a server-side firewall should allow the following types of packets:
* Incoming packets from 0.0.0.0 or dhcp-pool to dhcp-ip
* Incoming packets from any address to 255.255.255.255
* Outgoing packets from dhcp-ip to dhcp-pool or 255.255.255.255
where dhcp-ip represents any address configured on a DHCP server host and dhcp-pool stands for the pool from which a DHCP server assigns addresses to clients
An example in an ASA would similar to the following.
For blocking client:
access-list TEST extended deny udp any any eq bootpc
For blocking server:
or access-list TEST extended deny udp any any eq bootps
Hope that helps.
Maybe you are looking for
-
Here's the ordeal. I'm running a 2007 MacBook Pro 17 inch with Lion OS. When I converted to Lion, I didn't have enough room on my harddrive to convert to the new FileVault, so I remained on the old system. Less than a week ago I reboot my computer be
-
HT1349 How do i register a pre-owned ipad in my name
How do i re-register a pre-owned ipad in my name? An ipad that is registered in another person's name, but its sold to me. How do i register it in my name. NOTE: Am getting this message in my support profile "According to our records, this serial num
-
Why are fields in PDF blank on iPad?
When I create an Adobe PDF form with fields that can be filled in, the form can be opened and seen on an iPad, but the fields that have been filled in are blank. Can this be corrected?
-
Synchronised contacts not visible in Phone Browser
Started Nokia 6300 + PCSuite 6.84. After synchronization with Outlook 2003 I got all the contacts from PC to 6300 succsefully. But I do not see them in Phone Browser, so there is no possibility to adjust them directly. The only contacts I can see are
-
Keithley 6517B GPIB Write Error 7
Hello, I have a Keithley 6517B running and communicating with PC through GPIB. The program was initially running fine, and giving the current-noise signal against applied voltage (as programmed). But now when I run the program , it is giving an error