Traffic flowing through Fw

Hi Everyone,
We have SVI vlan on layer 3 core switch A.
this switch has connection to ASA and also to another B Layer 3 switch.
B Layer 3 switch connects to Layer 2 switch which has this vlan.
Need to undertsand traffic flow from user PC to Switch A.
Switch B has default route which is static to fw for subnet of vlan.
Now traffic goes from layer 2 switch to core Switch B then it has static route for that vlan which is ASA as next hop.
now traffic comes to ASA from there it goes to core Switch B which has SVI Vlan in it.
Also Core Switch A and B has trunk connection which carries that vlan.
Need to know if return traffic from core Switch A comes via ASA or by Switch B?
How can i check this?
Thanks
MAhesh

Hello Mahesh,
Not sure if I undertsood the topology but anyway the way to test this would be creating captures on the interface where you think the ASA should receive the traffic, if you do not see the packets there well that would lead us to the returning traffic going to Switch B.

Similar Messages

Problem Packet Flow through Cisco ASA Firewall

I have a Cisco ASA 5540 8.2(1), with permit ip any any rules
packet-tracer input inside tcp 10.56.149.129 871 10.40.170.10 3003
show
Phase: 1
Type: FLOW-LOOKUP
Subtype:
Result: ALLOW
Config:
Additional Information:
Found flow with id 1374599592, using existing flow
Result:
input-interface: inside
input-status: up
input-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule
if you change the source or destination port, the packet is successfully
clear conn did not help
please tell me how to solve the problem?

Hi,
I would suggest sharing the firewall configuration (except for any sensitive information they might have) so troubleshooting this would be easier.
It would seem to me that during your "packet-tracer" test there is already an existing traffic flow through the ASA with the same information that you entered in the command.
I don't know however why the connection would be blocked according to the "packet-tracer". In my own test this seemed to work. Output was otherwise the same but the "connection" wasnt dropped.
- Jouni

Trying to understand traffic Flow in a LWAPP wireless configuration.

I'm trying to understand at a high level how wireless traffic flow in the new LWAPP configuration. Based on what I can tell all wireless traffic must flow through the controllers prior to getting onto the LAN.
So lets say I have a LWAPP Access Point off an access switch in a remote closet and my controller is off my core switches. I want to communicate from my wireless PC to a wired PC on this same access switch. The traffic flows from the AP down to the core switch, through the Controller and back up to the access switch to the wired PC.
Is that correct?
If this is true my main concern is supporting APs from a central controller across a low speed WAN. Looks like I would not want to do that...

You're right in your assumption. Data traffic travels from the client to the AP. The AP then encapsulates this data using LWAPP and forwards it to the Controller. The WLC then de-encapsulates (?) it, processes the traffic as necessary and then drops it onto the wired LAN.
So, in your scenario, the wireless client would send data to the AP. This would be encapsulated between the AP and the controller and then sent back again unencapsulated to the wired client.
Regarding using this system over a low speed WAN, there are two ways of doing this.
The first is to use a local WLC at the remote site (e.g. a WLC2006 or the new WLC network module for 2800/3800 ISR routers).
The second is to use AP1030s which are 'Remote Edge Access Points'. These aren't quite as lightweight as the rest of the 1000 Series in that they will bridge local traffic and only encapsulate traffic heading 'off site'. They will also continue to operate if connection back to the WLC is lost (the first WLAN configured on the WLC remains up on the REAP whilst connection to the WLC is lost).
I believe that the recommendation for these is a minimum of 2Mbps WAN connection.

Dual wan failover config: failback does not always work as expected for existing LAN traffic flows

I have an 881 router configured with 2 dhcp WAN connections. I am trying to configure failure detection of the primary connection (I do not really care about the secondary at this time).
I have an ip sla/track configured to monitor the primary WAN connection, and if it stops passing traffic it removes that route, passing all traffic out the second WAN connection. When the first connection is restored it should restore the route and everything should pass through the first connection again. This works for all my tests except one. If I start a ping stream from a client "ping 8.8.8.8 -t" and disconnect the primary connection it will lose a few packets but then use the secondary connection in about 15 seconds. After restoring the primary connection all new traffic will use the primary connection, but the ping stream will then stop working (fails over, but not back). If I stop the ping stream for a time (not sure how long is required, but my test was over a minute) it will then use the primary connection like all other new traffic. A stop of a few seconds is not enough, and even opening up a second command prompt to ping the same target also does not work (pinging new targets works as desired). It is as if something is caching the route/session/whatever and it has to have a window of no traffic before expiring/relearning the route. This means any sustained traffic to the original target will not work until it is stopped for a certain time to let "something" age out.
I need to know if there is a way to "flush the cache" (or whatever) during fail-back to force the primary route to be used after fail-back, or something else that will have the same effect. My suspicion is that the second route gets "preferred" because the first is removed by the sla, and when the sla returns the route to the list the existing traffic flow is not aware of the route list change, using the last known good route (which now does not pass traffic). The Issue here is that it takes a length of time for the now bad route to get flushed, which is greater than I want to have.
config (edited):
interface FastEthernet3
description Backup ISP
switchport access vlan 800
no ip address
interface FastEthernet4
description Primary ISP
ip dhcp client route track 100
ip address dhcp
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
crypto ipsec client ezvpn EZVPN-to-1941
interface Vlan800
description Backup ISP
ip address dhcp
ip nat outside
ip virtual-reassembly in
track 100 list boolean or
object 101
object 102
track 101 ip sla 10 reachability
track 102 ip sla 20 reachability
ip sla 10
icmp-echo 4.2.2.2 source-interface FastEthernet4
threshold 1000
timeout 1500
frequency 5
ip sla schedule 10 life forever start-time now
ip sla 20
icmp-echo 208.67.222.222 source-interface FastEthernet4
threshold 1000
timeout 1500
frequency 5
ip sla schedule 20 life forever start-time now
ip route 4.2.2.2 255.255.255.255 FastEthernet4 permanent
ip route 10.1.2.0 255.255.255.0 <1941 wan ip removed>
ip route <1941 wan ip removed> 255.255.255.255 FastEthernet4 permanent
ip route 208.67.222.222 255.255.255.255 FastEthernet4 permanent
ip route 0.0.0.0 0.0.0.0 Vlan800 dhcp 254
ip route 0.0.0.0 0.0.0.0 FastEthernet4 dhcp
Observation: the last 2 routes appear in the order shown above. Even though the vlan800 route has a higher administrative cost it is in front of the FA4 route, could this be contributing to the issue? Is there a way to ensure the FA4 route is always listed before vlan800 at all times?

I have an 881 router configured with 2 dhcp WAN connections. I am trying to configure failure detection of the primary connection (I do not really care about the secondary at this time).
I have an ip sla/track configured to monitor the primary WAN connection, and if it stops passing traffic it removes that route, passing all traffic out the second WAN connection. When the first connection is restored it should restore the route and everything should pass through the first connection again. This works for all my tests except one. If I start a ping stream from a client "ping 8.8.8.8 -t" and disconnect the primary connection it will lose a few packets but then use the secondary connection in about 15 seconds. After restoring the primary connection all new traffic will use the primary connection, but the ping stream will then stop working (fails over, but not back). If I stop the ping stream for a time (not sure how long is required, but my test was over a minute) it will then use the primary connection like all other new traffic. A stop of a few seconds is not enough, and even opening up a second command prompt to ping the same target also does not work (pinging new targets works as desired). It is as if something is caching the route/session/whatever and it has to have a window of no traffic before expiring/relearning the route. This means any sustained traffic to the original target will not work until it is stopped for a certain time to let "something" age out.
I need to know if there is a way to "flush the cache" (or whatever) during fail-back to force the primary route to be used after fail-back, or something else that will have the same effect. My suspicion is that the second route gets "preferred" because the first is removed by the sla, and when the sla returns the route to the list the existing traffic flow is not aware of the route list change, using the last known good route (which now does not pass traffic). The Issue here is that it takes a length of time for the now bad route to get flushed, which is greater than I want to have.
config (edited):
interface FastEthernet3
description Backup ISP
switchport access vlan 800
no ip address
interface FastEthernet4
description Primary ISP
ip dhcp client route track 100
ip address dhcp
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
crypto ipsec client ezvpn EZVPN-to-1941
interface Vlan800
description Backup ISP
ip address dhcp
ip nat outside
ip virtual-reassembly in
track 100 list boolean or
object 101
object 102
track 101 ip sla 10 reachability
track 102 ip sla 20 reachability
ip sla 10
icmp-echo 4.2.2.2 source-interface FastEthernet4
threshold 1000
timeout 1500
frequency 5
ip sla schedule 10 life forever start-time now
ip sla 20
icmp-echo 208.67.222.222 source-interface FastEthernet4
threshold 1000
timeout 1500
frequency 5
ip sla schedule 20 life forever start-time now
ip route 4.2.2.2 255.255.255.255 FastEthernet4 permanent
ip route 10.1.2.0 255.255.255.0 <1941 wan ip removed>
ip route <1941 wan ip removed> 255.255.255.255 FastEthernet4 permanent
ip route 208.67.222.222 255.255.255.255 FastEthernet4 permanent
ip route 0.0.0.0 0.0.0.0 Vlan800 dhcp 254
ip route 0.0.0.0 0.0.0.0 FastEthernet4 dhcp
Observation: the last 2 routes appear in the order shown above. Even though the vlan800 route has a higher administrative cost it is in front of the FA4 route, could this be contributing to the issue? Is there a way to ensure the FA4 route is always listed before vlan800 at all times?

ASA 5505, how to configure DMZ to Inside traffic flows

Dear.
We have a Cisco ASA 5505 with an outside, inside and DMZ interface.
We really need all these interfaces.
The DMZ interface has been configured to block any traffic to the inside (restrict traffic flow). This restriction can’t be disable, an error occurred when doing this.
I will allow only one single port has access from DMZ to the inside, is that possible? And how?
Thanks for the feedback.
Regards.
Peter.

What i mean with "can't be disabled": when you navigate to Configuration/interfaces and select the DMZ interface / advanced, you can block traffic. By default Inside has been selected in the drop-down box. However, you can't leave it blank, you need to specify at least one. I can't create another, extra interfaces because the license is 3 max.
So, my question is: can I create a rule somewhere to overwrite this setting for only one specific port? And how?
Result of the command: "show version"
Cisco Adaptive Security Appliance Software Version 8.2(5)
Device Manager Version 6.4(5)
Compiled on Fri 20-May-11 16:00 by builders
System image file is "disk0:/asa825-k8.bin"
Config file at boot was "startup-config"
router up 100 days 1 hour
Hardware:   ASA5505, 512 MB RAM, CPU Geode 500 MHz
Internal ATA Compact Flash, 128MB
BIOS Flash Firmware Hub @ 0xffe00000, 1024KB
Encryption hardware device : Cisco ASA-5505 on-board accelerator (revision 0x0)
                             Boot microcode   : CN1000-MC-BOOT-2.00
                             SSL/IKE microcode: CNLite-MC-SSLm-PLUS-2.03
                             IPSec microcode : CNlite-MC-IPSECm-MAIN-2.05
0: Int: Internal-Data0/0    : address is a44c.11bb.5492, irq 11
1: Ext: Ethernet0/0         : address is a44c.11bb.548a, irq 255
2: Ext: Ethernet0/1         : address is a44c.11bb.548b, irq 255
3: Ext: Ethernet0/2         : address is a44c.11bb.548c, irq 255
4: Ext: Ethernet0/3         : address is a44c.11bb.548d, irq 255
5: Ext: Ethernet0/4         : address is a44c.11bb.548e, irq 255
6: Ext: Ethernet0/5         : address is a44c.11bb.548f, irq 255
7: Ext: Ethernet0/6         : address is a44c.11bb.5490, irq 255
8: Ext: Ethernet0/7         : address is a44c.11bb.5491, irq 255
9: Int: Internal-Data0/1    : address is 0000.0003.0002, irq 255
10: Int: Not used            : irq 255
11: Int: Not used            : irq 255
Licensed features for this platform:
Maximum Physical Interfaces    : 8
VLANs                          : 3, DMZ Restricted
Inside Hosts                   : 50
Failover                       : Disabled
VPN-DES                        : Enabled
VPN-3DES-AES                   : Enabled
SSL VPN Peers                  : 2
Total VPN Peers                : 10
Dual ISPs                      : Disabled
VLAN Trunk Ports               : 0
Shared License                 : Disabled
AnyConnect for Mobile          : Disabled
AnyConnect for Cisco VPN Phone : Disabled
AnyConnect Essentials          : Disabled
Advanced Endpoint Assessment   : Disabled
UC Phone Proxy Sessions        : 2
Total UC Proxy Sessions        : 2
Botnet Traffic Filter          : Disabled
This platform has a Base license.
Serial Number: xxxxxxxxxxxxxx
Running Activation Key: xxxxxxxxxxxxxxxxxxxxxxxxxxxx
Configuration register is 0x1
Configuration last modified by enable_15 at 14:43:11.295 CEDT Mon Sep 9 2013

Easy way to add members in hyperion reports that flow through levels

All,
I am creating a new report that I want it to flow through the generations properly without setting up each member and the children of that member manually. I would like to see the following:
Level 3 member
level 2 member
level 1
level 2 member
level 1
and so on.
Right now I have to add the level 3, then on the next line level 2 and the next line children of level 2. I have tried ancestors, siblings and descendants and it is giving me what I am looking for. I am afraid of doing it manually I will have a lot of maintenance when new level 2 members are added.
If anyone has an idea on how it can be done easier i would really appreciate it.
Thanks

Have you created parent child hierarchy or Value Hirerarchy.?. If we dont define it as value hierarchy any update on the Essbase side to this dimension will not reflect on OBIEE side . for these levels , refer to
http://www.rittmanmead.com/2010/07/obiee-11gr1-support-for-ragged-skip-level-value-based-hierarchies/
http://www.rittmanmead.com/files/rittman_oug_epm_2011.pdf
Hope this helps. Pls mark if it does.
Thanks,
SVS

All the traffic go through IPsec tunnel(site to site ) ,but something seems not working correctly

Hi, all,
I have seen a good post in google.com about how to make all the client's traffic though IPsec tunnel then out to the Internet from the Main site,now I attach this configuration and application for discussion, and what the problem is that I am still confused with the configuration on Main site , I hope anyone who can tell me more detail and how to accomplish it. Any answer will be appreciated , thank you !
Quote :
Question ? :
Mine is a very simple configuration. I have 2 sites linked via an IPsec tunnel. Dallas is my Main HQ R1 and Austin R2 is my remote office. I want all traffic from Austin to route thru the tunnel up to Dallas, then out to the Internet.
Dallas (Main) Lan Net is: 10.10.200.0/24
Austin (Remote) LAN Net is: 10.20.2.0/24
The Dallas (Main) site has a VPN config of:
Local Net: 0.0.0.0/0
Remote Net: 10.20.2.0/24
The Austin (Remote) site has a VPN config of:
10.20.2.0/24
Remote Net: 0.0.0.0/0
The tunnel gets established just fine. From the Austin LAN clients, I can ping the router at the main site (10.10.200.1). This is how I know the tunnel is created, but I cannot ping anything beyond the router from the Austin LAN, e.g. 8.8.8.8.
I'm sure it's something simple I failed to configure. Anyone have any pointers or hints?
Answer:
Thanks to Jimp from the other thread, I was able to see why it was not working. To fix, I had to change the Outbound NAT on the main side to Manual. Then I created a new Outbound NAT rule that included the subnet from the Austin network (10.20.2.0). Basically, I just created a copy of the default rule and changed the Source network.
Once I made this change, Voila! Traffic from the remote side started heading out to the Internet. Now all traffic flows thru the Main site. It makes perfect sense why I needed to make this change, it just took a slap in the head from Jimp to point me in the right direction.
My question ?
The answer said "To fix, I had to change the Outbound NAT on the main side to Manual. Then I created a new Outbound NAT rule that included the subnet from the Austin network (10.20.2.0). Basically, I just created a copy of the default rule and changed the Source network." what this mean and
how to do it , could anybody give me the specific configuration ? thanks a lot.

Thank you for Jouni's reply, following is the configuration on Cisco 2800 router ,no firewall enable, :
crypto isakmp policy 100
encr aes 256
authentication pre-share
group 2
crypto isakmp key x.x.x address 0.0.0.0 0.0.0.0
crypto isakmp keepalive 60
crypto ipsec transform-set IPsectrans esp-3des esp-md5-hmac
crypto dynamic-map IPsecdyn 100
set transform-set IPsectrans
match address 102
crypto map IPsecmap 100 ipsec-isakmp dynamic IPsecdyn
interface Loopback1
ip address 10.10.200.1 255.255.255.0
interface FastEthernet0/0
ip address 113.113.1.1 255.255.255.128
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
crypto map IPsecmap
interface FastEthernet0/1
ip address 192.168.1.1 255.255.255.0
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
ip route 0.0.0.0 0.0.0.0 113.113.1.2
ip http server
no ip http secure-server
ip nat inside source list 100 interface FastEthernet0/0 overload
access-list 100 permit ip 192.168.1.0 0.0.0.255 any
access-list 102 permit ip any 10.20.2.0 0.0.0.255

Hi,When I submit the budget for approval, it is approved and base lined when we submit it for approval. It does not go in approval hierarchy. We want it to flow through approval hierarchy.

Hi,When I submit the budget for approval, it is approved and base lined when we submit it for approval. It does not go in approval hierarchy. We want it to flow through approval hierarchy.

Hi Amit,
if I understand correctly, you just need for a particular object a tooltip to be showed.
There is no such functionality hence you used the trick of using a hyperlink, which if clicked generates undesired behavior.
Hyperlinks don't allow themselves to be disabled, therefore if you are using that workaround you must cope with that.
I would suggest to create an Idea at [https://ideas.sap.com] for having in the properties of an object a tooltip, then post the link to the idea here and other users will vote if they like the idea.
Thanks and regards,
Simone

Aperture - flow through to IPhone/IPad Photos

Could someone please explain to me how the Aperture 3 Albums (and related photos) flow through to the Photo App on my IPhone and IPad?
Some photos show up immediately, some show up in an hour, some never show up ... am i missing something?
Does my IPhone/IPad need to be connected to the computer to get updated?
Sometimes it is, sometimes it is not?
Is there a way to force sync to Aperture 3?
Thanks in Advance
Mark

Mark,
the most reliable way to sync your albums and projects using iTunes. Connect your iPad/iPhone to your computer using USB. The will appear in iTunes in the "Devices" section of the Library inspector, and when you select them, you can select in the "Photos" tab the albums and projects that you want to sync. This will sync immediately.
The other way to transfer images is the Photo stream. This will sync, when the network is available and the photo stream is enable on both devices.
Regards
Léonie

SAP Retail - Flow-through vs putaway quantities

Hi!
My customer receives in his DC and ships same day 80% of his units, using a "flow-through merch driven" type process (for which we need a lean WM warehouse). The other 20% goes in putaway stock (for which we need a full WM warehouse) for future replenisment. We therefore need 2 storage locations to point on these 2 warehouses. On the other hand, we do not want to create 2 PO line items per sku: we want to be able to easily post the stock in the proper storage location upon goods receipt.
Would anyone have faced this situation, and would have found a way to resolve it?
Thanks.
Sebastien

Dear Sebastien,
It is important to understand that, although the term "split" is used here, an
individual item within a transfer order is not split into smaller items, regardless of
the quantity in that item. The items are not changed. Instead, the items within a
single transfer order are distributed (spread out) among two or more transfer orders.
In the Customizing application, you can define whether a transfer order split is to take place and select a mix of detailed criteria that affect the split. A customer exit is also available to define your own criteria for this task. For instructions on how to set up your system for the TO split, see
Activities -> Transfers -> Processing performance data / TO split -> Define profiles in the Warehouse Management IMG documentation.
The following transfer order split capabilities are available.
Split according to movement unit is viewed as a separate function that is processed independently from the other split criteria.
For each movement unit (SUT in an item) a split is planned. The TO contains an item with exactly one movement unit. The split is necessary when the actual data is recorded and plays a role in the calculation of the planned times. Based on the Customizing definition, you can switch off the split function and decide to use the standard process.
Sorting items in the transfer order.
The items in the TO are sequenced so that the document created for the TO lists the storage bins from which materials are to picked in an optimal sort order for processing. The routes are minimized and, consequently, the planned and actual processing times. An additional field in the storage bin defines a sequence for all bins in the warehouse. The customer maintains this field.
Transfer orders can also be split according to the following criteria:
Storage type/section
Planned transfer order processing time
Quantity of containers / weight / volume
Mix (combination of named criteria)
Regards,
Naveen.

Cross docking and flow throughs

Hi Gurus,
Can anyboday send me configuration steps in cross docking and flow through scenarios in is retail.
thanks in advance.
Regards,
PS

Hi,
Explore following URL
Collective Purchase Order
Bye,
Muralidhara

IS Retail-Recipient Driven Merchandise distribution Flow through

Hi
On receipt of goods how the delivery document is created automatically for the recipient driven flow through .
Now for me In WF60 delivery document is not getting craeted says "No processing doc found" .How the automatic delivery document is getting created at the point of GR.
Pls explain me in detail,wat are the necessary configs needed .

Hi Kumar,
The following link will help you to solve your query:
help.sap.com/bp_retailv1470/documentation/EN/Merchandise%20Distribution_EN_DOCU_V147.doc
Regards,
ManiKumaar

Project Server 2010 permissions granted through RBS are not flowing through to Project Sites.

Hi,
I have configured RBS as "The Project Owner is a descendant of the user via RBS" its working fine for Projects.
But users are facing access denied issue when working with project sites RBS is not working for project sites.
Can any one Help me How can i grant permissions Automatically for project sites also as same like projects is it possible ?
The Members in Executives group can see all projects in organization but same like can they see all project sites ?
I have found one blog of
RaymondRis he is recommending to do it manually as its not possible to grant Project site permissions Automatically.
http://blogs.technet.com/b/raymond_ris/archive/2013/05/09/project-server-2010-permissions-granted-through-rbs-are-not-flowing-through-to-project-sites.aspx
Thank You, Kumar KSV

Kumar,
The permissions to project sites is not cotrolled by the RBS, as you have discovered. It is controlled by the Security Category permisisons, and the settings if the permssions are auto synced. The permissions work like this:
Project managers who have published a project or who have Save Project permissions on a project are added to the Project Managers (Microsoft Project Server) site group.
Team members with assignments in a project are added to the Team members (Microsoft Project Server) site group.
Other Project Server users who have View Project Site permission on a project are added to the Readers (Microsoft Project Server) site group.
As long as you use the Auto Sync of permisisons for project sites, i do not think there is any work around.
Cheers,
Prasanna Adavi, Project MVP
Blog:
Podcast:
Twitter:
LinkedIn:

Black box able to log traffic passing through...

Hi
I'm looking for a box able to sniff the tcp/ip traffic (source ip address, destination ip address and ports) passing from it's ingress interface to the egress interface and viceversa (useful the bypass option if this box fails) without any change of the traffic passing through, just logging it and sending this log to a syslog server.
We need it as solution to be compliant with the new police law against computer criminals where is written that all the internet traffic has to be logged (we offer sometimes transparent internet access to our customers where we do not put any kind of equipment as firewall, proxy or something else, only the router providing the internet access).
Do you know if Cisco provide something like that ? Other vendors ?
Any other idea how to be compliant with this request ?
Thanks
Pls advise
Ric

Cisco Intrusion Prevention System Sensor can be used to log ip traffic. You can manually configure the sensor to capture all IP traffic associated with a host you specify by IP address. You can specify how long you want the IP traffic to be logged, how many packets you want logged, and how many bytes you want logged. The sensor stops logging IP traffic at the first parameter you specify.You can also have the sensor log IP packets every time a particular signature is fired. You can specify how long you want the sensor to log IP traffic and how many packets and bytes you want logged

Documents which have not flowed through to FI from Purchasing

Does a Transaction exist which will display the documents that have not flowed through to Finance from Purchasing? Similar to VFX3 in Sales.
For example, a MIRO that has a wrong posting date and the document has been saved but has not flowed through to Finance.

You may have to create a report on SAP query, linking RBKP (the incoming invoice table) with BKPF. In BKPF table the invoice document and the fiscal year are concatenated and resides in the field AWKEY as the reference no.
If, for any combination of invoice and fiscal year you do not find a value in BKPF, this could be construed as those that do not have FI document generated.

Traffic flowing through Fw

Similar Messages

Maybe you are looking for