Vlan and two outside interface

Hi ,
Now my current asa 5510 is production as one inside interface (e0/1), one dmz(e0/2) interface and one outside interface(e0/0).
I want to add one more isp as outside 1 interface(e0/3).
Inside interface(e0/1) I will configure two vlans as one vlan for current network 192.168.1.0/24 and another one vlan for new network 192.168.10.0/24 to new isp with interface (e0/3).
Is it possible to work?
Aung

Hi,
So you are basically looking into configuring 2 separate LAN and WAN connections. Both LANs will use their own WAN link to ISP also.
I am not that sure about this on the 8.2 (or lower) software level but have tested this on 8.4 - 9.1 software levels. Then again this is not officially supported by Cisco so you would never know if it suddenly stopped working.
Generally Cisco ASAs support having 2 ISP links but only 1 of them would be active at one given time.
To have 2 different LAN networks use their own WAN link requires special NAT configurations to accomplish that.
What is your current software level on the ASA?
- Jouni

Similar Messages

Static NAT with two outside interfaces

I have a router, which performs NAT on two outside interfaces with load balancing and had a task to allow inbound connection to be forwarded to the specific host inside on a well known port.
here is example
interface Fas0/0
ip nat outside
interface Fas0/1
ip nat outside
interface Vlan1
ip nat inside
ip nat inside source route-map rm_isp1 pool pool_isp1
ip nat inside source route-map rm_isp2 pool pool_isp2
all worked fine
then i tried to add static nat
ip nat inside source static tcp 10.0.0.1 25 interface Fas0/0 25
ip nat inside source static tcp 10.0.0.1 25 interface Fas0/1 25
and in result only last static NAT line appeared in config.
the solution was to use interface's IPs instead of names. that helped but isn't that a bug?

In this scenario, we are trying to access a mail server located at
10.0.0.1 from outside and we have two outside IP, let's say, 71.1.1.1 and
69.1.1.1.
With CEF Enabled
Packet comes in to Fa0/0 interface with Source IP 66.x.x.x and
Destination IP 71.1.1.1. Our NAT rule translates this to 10.0.0.1.
Packet goes to 10.0.0.1. The return packet goes to the LAN interface
first and the routing rule is determined *before* the packet is
translated.
Packet source IP at this point is 10.0.0.1 and destination is
66.x.x.x. Now, based on CEF, it will go out via Fa0/0 or Fa0/1,
irrespective of the way it came in. Because of this, with CEF enabled
this will not work. CEF is per-destination.
So, let's say somebody on outside tried to access this server using 71.1.1.1, then he would
expect a reply from 71.1.1.1 which may or may not be true as the traffic could be Nat'd to 69.1.1.1 or 71.1.1.1.
If it gets reply packet from 71.1.1.1, it should work.
If it gets it from 69.1.1.1, it will simply drop it as it never sent a
packet to 69.1.1.1.
With CEF and Fast Switching Disabled
Same steps as above, only that the packet is sent to the process level
to be routed. At this point, the packets will be sent out in a round
robin fashion. One packet will go out via the Fa0/0 and the other via the
Fa0/0. This will have a constant 50% packet loss and is also not a
viable solution.
So, what are you trying to achieve is not possible on Cisco router.
HTH,
Amit Aneja

Two outside interfaces

Hello everyone,
I am wondering if it's possible to have two outside interfaces in two diferent public networks on my ASA 5505. How do you think?

Hi Julio,
I read about redundancy but what i need is different. I have here in the office a cisco router belong to the ISP. I have a backup link connected to the second WAN port of this router and only one link going in my ASA. So when there is a problem with the primary the backup take the primary function and in the both case i have the same public ip scope.
My issue is that the same ISP gave my scond different public ip scope which go out from the same router and is unsecure network. I want some how both public ip scope to be usable at the same time but going thrue the ASA. I dont know if you understand me. but this what i imagine.

Connectig an AP1131 act as WGB to AP root with two VLANS and two SSIDs

Someone Knows, if I can connect an AP 1131 configured as WGB to other AP 1131 acting as root with 2 Vlans and 2 SSIDs, and pass all of them to the WGB ethernet port, a mean, passing the traffic from the 2 differents VLANs with two differnts IP range from the ethernet AP root port, to the ethernet WGB port.
Thanks.

Unfortunately it will not play. AP as a WGB can cary only one (native) VLAN. For interconnecting more VLANs you need a full wireless bridge but it cannot be AP11xx.

ASA 5525X - Multiple Outside Interface

Hello,
Question:
I have a pair of ASA 5252X for VPN Traffic, the interfaces are:
- Inside
- DMZ
- Outside - ISP1 - IP 1.1.1.1
I can have two "outside" interfaces, multiple ISP's for VPN traffic(Site to Site)?
- Inside
- DMZ
- Outside - ISP1 - IP 1.1.1.1
- Outside2 - ISP2 - IP 2.2.2.2
I need this because i have problems with only one ISP, so i need to install more one and in the remote peer add a second peer IP(for ISP2), so if the remote peer cannot establish the connection over the ISP1, he going to ISP2, it's possible?
Tks.
Rafael

Yes Rafael, it possible.
you need to configure SLA monitoring on ASA for the ISP failover.
And for the VPN add the second ISP ip as a back up peer on the remote device.
on your ASA where you have dual iSP, the same crypto map will be applied on both the interface.
In case if you need any assistance regarding the configuration let me know.
Configuration should look something like this:
interface Ethernet0
nameif outside
security-level 0
ip address 10.200.159.2 255.255.255.248
interface Ethernet2
nameif inside
security-level 100
ip address 172.22.1.163 255.255.255.0
interface Ethernet1
nameif backup
security-level 0
ip address 10.250.250.2 255.255.255.248
access-list outside_crypto_1 permit ip 172.22.1.0 255.255.255.0 (your internal private ip) x.x.x.x x.x.x.x (remote site internal ip you want to access)
access-list nonat permit ip 172.22.1.0 255.255.255.0 (your internal private ip) x.x.x.x x.x.x.x (remote site internal ip you want to access)
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
crypto map outside_map 20 match address outside_crypto_1
crypto map outside_map 20 set peer x.x.x.x (Public ip of the remote site)
crypto map outside_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map interface outside
crypto map outside_map interface backup
crypto isakmp enable backup
crypto isakmp enable outside
global (outside) 1 interface
global (backup) 1 interface
nat (inside) 1 172.22.1.0 255.255.255.0
nat (inside) 0 access-list nonat
tunnel-group x.x.x.x (public ip of the remote site) type ipsec-l2l
tunnel-group x.x.x.x ipsec-attributes
pre-shared-key cisco123
route outside 0.0.0.0 0.0.0.0 10.200.159.1 1 track 1
route backup 0.0.0.0 0.0.0.0 10.250.250.1 254
sla monitor 123
type echo protocol ipIcmpEcho 10.0.0.1 interface outside
num-packets 3
frequency 10
sla monitor schedule 123 life forever start-time now
track 1 rtr 123 reachability
Important Information:
===============================================
** With the use of track ASA will keep on monitor the MPLS interface (outside in this example) with the help of ICMP packets. The moment it will stop getting the replies it will flush the primary route and start pointing the routes toward the back up interface.
** Crypto map will be applied on the back up interface and the remote site should you the public ip of the back up interface as VPN peer.
** As soon as ASA will start getting the reply from the outside interface it will again start pointing the routes towards the MPLS interface.
** I hope this will answer your query.
Thanks
Jeet

Wirless Vlans and DHCP

I am trying to configure my Aironet 1121G acess points with several vlans, got the vlans all working fine with wired devices, but the wirless devices don't get DHCP.
Basically, I have the BVI on my managment vlan and two other vlans that pass through, trying to have the public WiFi on 1 vlan and two corporate vlans with seperate wifi. can't get IPs on any of them though.
Vlnas are routed by a catlayst 3550 with helper addresses configured on all the vlan interfaces.
DHCP comes from 2 windows server 2003 boxes on a further vlan
any Ideas?

Vinod,
Here is the AP config, I'm confused, so any help would be useful, got to get a wireless course under my belt.
Cheers,
Peter
version 12.3
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
hostname IT_AP1121G_01
no logging console
enable secret
ip subnet-zero
aaa new-model
aaa group server radius rad_eap
aaa group server radius rad_mac
aaa group server radius rad_acct
aaa group server radius rad_admin
aaa group server tacacs+ tac_admin
aaa group server radius rad_pmip
aaa group server radius dummy
aaa authentication login eap_methods group rad_eap
aaa authentication login mac_methods local
aaa authorization exec default local
aaa accounting network acct_methods start-stop group rad_acct
aaa session-id common
dot11 vlan-name Corporate vlan 3
dot11 vlan-name Default vlan 1
dot11 vlan-name Managment vlan 2
dot11 ssid stosWIFI
vlan 1
authentication open
guest-mode
mbssid guest-mode
infrastructure-ssid optional
mobility network-id 1
dot11 ssid stoswaldsWIFI
vlan 3
authentication open eap eap_methods
mobility network-id 3
username admin privilege 15 secret 5 $1$.dBF$jstGCUjGPaD6OQ/JVmZEY1
bridge irb
interface Dot11Radio0
no ip address
no ip route-cache
shutdown
encryption key 1 size 128bit 7 0D1A262E215F252C7E5A2D6A6498 transmit-key
encryption mode wep mandatory
encryption vlan 1 key 1 size 128bit 7 DA303E012047F6068707FC131B4A transmit-key
encryption vlan 1 mode wep mandatory
encryption vlan 3 mode wep mandatory
ssid stosWIFI
ssid stoswaldsWIFI
mbssid
speed basic-1.0 basic-2.0 basic-5.5 basic-6.0 basic-9.0 basic-11.0 basic-12.0 basic-18.0 basic-24.0 basic-36.0 basic-48.0 basic-54.0
channel 2412
station-role root
world-mode dot11d country GB both
interface Dot11Radio0.1
encapsulation dot1Q 1 native
no ip route-cache
bridge-group 254
bridge-group 254 subscriber-loop-control
bridge-group 254 block-unknown-source
no bridge-group 254 source-learning
no bridge-group 254 unicast-flooding
bridge-group 254 spanning-disabled
interface Dot11Radio0.3
encapsulation dot1Q 3
no ip route-cache
bridge-group 3
bridge-group 3 subscriber-loop-control
bridge-group 3 block-unknown-source
no bridge-group 3 source-learning
no bridge-group 3 unicast-flooding
bridge-group 3 spanning-disabled
interface FastEthernet0
no ip address
no ip route-cache
duplex auto
speed auto
interface FastEthernet0.1
encapsulation dot1Q 1
no ip route-cache
bridge-group 254
no bridge-group 254 source-learning
bridge-group 254 spanning-disabled
interface FastEthernet0.3
encapsulation dot1Q 3
no ip route-cache
bridge-group 3
no bridge-group 3 source-learning
bridge-group 3
interface FastEthernet0.2
encapsulation dot1Q 2 native
no ip route-cache
bridge-group 1
no bridge-group 1 source-learning
bridge-group 1 spanning-disabled
interface BVI1
ip address 192.168.2.33 255.255.255.0
no ip route-cache
ip default-gateway 192.168.2.1
ip http server
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
ip radius source-interface BVI1
logging trap notifications
logging
radius-server attribute 32 include-in-access-req format %h
radius-server vsa send accounting
control-plane
bridge 1 route ip
line con 0
password
line vty 0 4
password
line vty 5 15
end

I have a VSS failure and two 6509 were all out of work.

Hi,
      standby 6509 sup in VSS crashed, and remain in rommon status and hadn't come back untill we reload it on the moring,
      but we found active 6509 shutdown all it's MEC interfaces , and standby 6509 remain in rommon status,so we run into a totoally out of work situation untill we reload standby box on the morning.
     customer lost communication for almost 8 hours, because fail happened at middle night.
     is there any mechanism like VPC auto recovery to config on VSS.
    this is ridiculous , because we have one full function 6509 but lost all communication in this failure.
     how can i avoid this , we config VSL and fast hello dual-active detection. but can't recovery automactilly from this fail
    another question: cisco support community change it's web page i can't find my post.
     thank you!
Tom

HiHi
Thank you
    two 6509 VSS, has one interface each box connect a layer 3 swtichA through portchannel. I found two interface on switchA also down and nerver come on until we reload standby 6509, and ospf neighbor to this switchA was also down.
    we config two tengigabit eth interface on diifferen line card as VSL, and two gigabit interface as fast hello dual-active detect interface.
   found log as below from active 6509
   but custmer didn't check active 6509 status and reboot standby 6509 directly to recovery.
    I think active 6509 shutdown it's interface and standby 6509 remain in rommon status, two 6509 all were out of services , so everything were lost for 8 hours.
    I think during standby 6509 crash( i can find crash file to to memory parity error), there is little time , active 6509 still can detect dual active through fast hello, so active 6509 shutdown it's interfaces, but unfortrunately standby 6509 reamin in rommon status, two box were out of work at same time.
    if standby 6509 are totally down(or crash,or power down) , does actice 6509 shutdown interfaces?( I think this is not correct behavior, active 6509 should keep working?)
    if active 6509 are totally down( or crash), does standby 6509 take over,
    If my thoughts is correct, this is rididuculous, because i can't avoid whole standby 6509 crash or power down.
    but if standby 6509 is down, how can active 6509 know standby 6509 is down or VSL and dual-active detect interface are all down to avoid dual active.
   is there any possible to find a way: if standby 6509 is down or crash , active 6509 can detect this is not a dual active,and remain working.
if VSL and dual active detect interface are all down, two 6509s can detect this dual active and active 6509 shutdown it's interface
thank you!
Tom
LL to DOWN, Neighbor Down: Interface down or detached
Mar 17 23:31:27.440: SW1_SP: Switch 2 Physical Slot 1 - Module Type LINE_CARD removed
Mar 17 23:31:27.939: SW1_SP: Switch 2 Physical Slot 3 - Module Type LINE_CARD removed
Mar 17 23:31:28.175: SW1_SP: Switch 2 Physical Slot 8 - Module Type LINE_CARD removed
Mar 17 23:31:28: %SATVS_IBC-SW1_SP-5-VSL_DOWN_SCP_DROP: VSL inactive - dropping cached SCP packet: (SA/DA:0x4/0x4, SSAP/DSAP:0x18/0x0, OP/SEQ:0x320/0x66AF, SIG/INFO:0x1/0x501, eSA:0000.0500.0000)
Mar 17 23:31:29: %OSPF-5-ADJCHG: Process 2011, Nbr 10.218.96.51 on Vlan181 from FULL to DOWN, Neighbor Down: Interface down or detached
Mar 17 23:31:29.163: SW1_SP: Switch 2 Physical Slot 9 - Module Type LINE_CARD removed
Mar 17 23:31:36: %VSDA-SW1_SP-3-LINK_DOWN: Interface Gi1/1/23 is no longer dual-active detection capable
Mar 17 23:31:36: %VSDA-SW1_SP-3-LINK_DOWN: Interface Gi1/1/24 is no longer dual-active detection capable

Configuration for bundling two BRI interface together

Can someone provide the ISDN DDR solution for configuring two BRI interface ( Bundled together - MPPP ) for achieving 256K bandwidth. I have two seperate ISDN lines and two BRI interfaces installed in the routers at both the point to point sites. The ISDN dialup shall be used as backup link.

look at this link it will help you:http://www.cisco.com/en/US/tech/tk713/tk507/technologies_configuration_example09186a00800a3b7a.shtml
remeber to rate this post if it helps
regards
Devang

Not able to telnet or ssh to outside interface of ASA and Cisco Router

Dear All
Please help me with following question, I have set up testing lab, but still not work.
it is Hub and spoke site to site vpn case, connection between hub and spoke is metro-E, so we are using private ip for outside interface at each site.
Hub -- Juniper SRX
Spoke One - Cisco ASA with version 9.1(5)
spoke two - Cisco router with version 12.3
site to site vpn has been successful established. Customer would like to telnet/ssh to spoke's outside ip from Hub(using Hub's outside interface as source for telnet/ssh), or vise versa. Reason for setting up like this is they wants to be able to make configuration change even when site to site vpn is down. Sound like a easy job to do, I tried for a long time, search this forum and google too, but still not work.
Now I can successfully telnet/ssh to Hub SRX's outside interface from spoke (ASA has no telnet/ssh client, tested using Cisco router).
Anyone has ever done it before, please help to share your exp. Does Cisco ASA or router even support it?
When I tested it, of cause site to site vpn still up and running.
Thanks
YK

Hello YK,
On this case on the ASA, you should have the following:
CConfiguring Management Access Over a VPN Tunnel
If your VPN tunnel terminates on one interface, but you want to manage the ASA by accessing a different interface, you can identify that interface as a management-access interface. For example, if you enter the ASA from the outside interface, this feature lets you connect to the inside interface using ASDM, SSH, Telnet, or SNMP; or you can ping the inside interface when entering from the outside interface. Management access is available via the following VPN tunnel types: IPsec clients, IPsec LAN-to-LAN, and the AnyConnect SSL VPN client.
To specify an interface as a mangement-only interface, enter the following command:
hostname(config)# management access management_interface
where management_interface specifies the name of the management interface you want to access when entering the security appliance from another interface.
You can define only one management-access interface
Also make sure you have the pertinent configuration for SSH, telnet, ASDM and SNMP(if required), for a quick test you can enable on your lab Test:
SSH
- ssh 0 0 outside
- aaa authentication ssh console LOCAL
- Make sure you have a default RSA key, or create a new one either ways, with this command:
*crypto key generate rsa modulus 2048
Telnet
- telnet 0 0 outside
- aaa authentication telnet console LOCAL
Afterwards, if this works you can define the subnets that should be permitted.
On the router:
!--- Step 1: Configure the hostname if you have not previously done so.
hostname Router
!--- aaa new-model causes the local username and password on the router
!--- to be used in the absence of other AAA statements.
aaa new-model
username cisco password 0 cisco
!--- Step 2: Configure the router's DNS domain.
ip domain-name yourdomain.com
!--- Step 3: Generate an SSH key to be used with SSH.
crypto key generate rsa
ip ssh time-out 60
ip ssh authentication-retries 3
!--- Step 4: By default the vtys' transport is Telnet. In this case,
!--- Telnet and SSH is supported with transport input all
line vty 0 4
transport input All
*!--- Instead of aaa new-model, the login local command may be used.
no aaa new-model
line vty 0 4
login local
Let me know how it works out!
Please don't forget to Rate and mark as correct the helpful Post!
David Castro,
Regards,

Cisco SG 300-10 VLAN and IP Interface Question

Hello,
Please forgive me if you find my question too basic. But, I would really appreciate an answer as I am having a heck of a time getting the VLANs to work. I have several VLANs configured as follows, but, my question is related only two VLANS: VLAN 104 and VLAN 2000. Followings are the screenshots. I have connected cable from Port 6 of the switch to the NIC2 of Windows 8.1 PC. When I use GE6 as access port for VLAN 104, I am able to ping to the NIC2 configured with static IP 10.10.30.30. However, when use GE as Trunk Port for VLAN 104 and 2000, I am not able to ping the NIC2 configured with static IP 10.10.30.30 or static IP 10.10.110.30. I am using the ping utility from the GUI.
If there is a better way to test the trunk port, please let me know.
At this point, I am assuming that something is wrong with my configuration as the NIC2 is unable to receive IP address.
The other assumption is that NICs with Windows 8.1 OS does not accept Traffic from Tagged VLANS.
VLAN TableShowing 1-11 of 1110203050per page
VLAN ID
VLAN Name
Originators
VLAN Interface State
Link Status
SNMP Traps
1
Default
Enabled
Enabled
100
Management A
Static
Disabled
Enabled
101
Management B
Static
Disabled
Enabled
102
VXLAN A
Static
Disabled
Enabled
103
VXLAN B
Static
Disabled
Enabled
104
vMotion
Static
Enabled
Enabled
105
IP Storage
Static
Disabled
Enabled
106
HQ Uplink
Static
Disabled
Enabled
107
HQ Access
Static
Disabled
Enabled
1000
Test VLAN
Static
Disabled
Enabled
2000
Test2 VLAN
Static
Enabled
Enabled
Port VLAN Membership Table
Filter:
Interface Type
equals to
PortLAG
Go
Interface
Mode
Administrative VLANs
Operational VLANs
LAG
GE1
Trunk
1UP
1UP
GE2
Trunk
1UP
1UP
GE3
Trunk
1UP
1UP
GE4
Trunk
1UP
1UP
GE5
Trunk
1UP
1UP
GE6
Trunk
1UP, 104T, 2000T
1UP, 104T, 2000T
GE7
Trunk
1T, 100UP, 101T, 102T, 103T, 104T, 105T, 106T, 107T
1T, 100UP, 101T, 102T, 103T, 104T, 105T, 106T, 107T
GE8
Trunk
1T, 100UP, 101T, 102T, 103T, 104T, 105T, 106T, 107T
1T, 100UP, 101T, 102T, 103T, 104T, 105T, 106T, 107T
GE9
Trunk
1T, 100UP, 101T, 102T, 103T, 104T, 105T, 106T, 107T
1T, 100UP, 101T, 102T, 103T, 104T, 105T, 106T, 107T
GE10
Trunk
1T, 100UP, 101T, 102T, 103T, 104T, 105T, 106T, 107T
1T, 100UP, 101T, 102T, 103T, 104T, 105T, 106T, 107T
IPv4 Interface TableShowing 1-11 of 1110203050per page
Interface
IP Address Type
IP Address
Mask
Status
VLAN 105
Static
10.10.20.1
255.255.255.0
Valid
VLAN 104
Static
10.10.30.1
255.255.255.0
Valid
VLAN 2000
Static
10.10.110.1
255.255.255.0
Valid
VLAN 1
Static
192.168.0.39
255.255.255.0
Valid
VLAN 1000
Static
192.168.1.1
255.255.255.0
Valid
VLAN 106
Static
192.168.100.1
255.255.255.0
Valid
VLAN 100
Static
192.168.110.1
255.255.255.0
Valid
VLAN 107
Static
192.168.130.1
255.255.255.0
Valid
VLAN 102
Static
192.168.150.1
255.255.255.0
Valid
VLAN 101
Static
192.168.210.1
255.255.255.0
Valid
VLAN 103
Static
192.168.250.1
255.255.255.0
Valid
Ping
Host Definition:
By IP address
By name
IP Version:
Version 6
Version 4
<tr id="trSourceIP" display:none"="">
Source IP:
Auto10.10.20.1(VLAN105)10.10.30.1(VLAN104)10.10.110.1(VLAN2000)192.168.0.39(VLAN1)192.168.1.1(VLAN1000)192.168.100.1(VLAN106)192.168.110.1(VLAN100)192.168.130.1(VLAN107)192.168.150.1(VLAN102)192.168.210.1(VLAN101)192.168.250.1(VLAN103)Autofe80::5267:aeff:fe3d:83b3(VLAN1)Auto10.10.20.1(VLAN105)10.10.30.1(VLAN104)10.10.110.1(VLAN2000)192.168.0.39(VLAN1)192.168.1.1(VLAN1000)192.168.100.1(VLAN106)192.168.110.1(VLAN100)192.168.130.1(VLAN107)192.168.150.1(VLAN102)192.168.210.1(VLAN101)192.168.250.1(VLAN103)fe80::5267:aeff:fe3d:83b3(VLAN1)
Destination IPv6 Address Type:
Link Local
Global
Link Local Interface:
VLAN 1
Destination IP Address/Name:
Ping Interval:
Use Default
User Defined
ms (Range: 0 - 65535, Default: 2000)
Number of Pings:
Use Default
User Defined
(Range: 1 - 65535, Default: 4)
Status:

Tom and Michal, your response is much appreciated. You are 100% right. The issue was with the Windows recognizing the VLAN tags. I have tested trunking by using the vmxnet3 driver from VMware and it works.
I had another question where I can use your help too. I am not sure how to connect two Cisco SG300 switches - one with L3 mode and the second one with L2 mode. I have configured GVRP for Port 5 of both switches and run a cable connecting to Port 5 of each switch. I have made port 5 of both switches trunk mode ( 1U, 1000T). I have created VLAN 1000 on both switches. With L3 switch, I have added IP Interface (192.168.100.1) to VLAN 1000. My issues is that, I am not able to access the management port (192.168.1.238) of the L2 switch. Note that the L2 switch has only on uplink, which is to the L3 switch. Since the Port 5 also receives untagged traffic from VLAN1 (192.168.1.1), I am assuming that it would receive the management network from VLAN1.

Input and CRC errors on ASA 5505 outside interface

All,
I see input and crc errors on my ASA 5505 eth0/0(outside) interface and packet drops. There is very slow connection though we have 20mb line. ISP also sees the issue on the Lan interface side. We have the speed and duplex configured same on both ISP and our end.
I am suspecting if this is Physical cable issue. Please suggest.
Hardware is 88E6095, BW 100 Mbps, DLY 100 usec
        Full-Duplex(Full-duplex), 100 Mbps(100 Mbps)
        Input flow control is unsupported, output flow control is unsupported
        Available but not configured via nameif
        MAC address 001a.b4c9.f3d9, MTU not set
        IP address unassigned
        158138067 packets input, 141061681082 bytes, 0 no buffer
        Received 183037 broadcasts, 0 runts, 0 giants
        19642 input errors, 19642 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
        0 pause input, 0 resume input
        0 L2 decode drops
        144684 switch ingress policy drops
        124291353 packets output, 38197278051 bytes, 0 underruns
        0 pause output, 0 resume output
        0 output errors, 0 collisions, 0 interface resets
        0 late collisions, 0 deferred
        0 rate limit drops
        0 switch egress policy drops
        0 input reset drops, 0 output reset drops

Hello Ravi,
This kind of issues CRCs/ Input Errors are tipically known as L1 issues so make sure you check the cable and if that does not make a difference change the port on each side to see if there is a difference.
Unfortunetly the ASA does not support the Time-Domain Reflectometer feature so we must do the test of L1 by ourselfs.
Can you clear the counters of the interface, test the changes provided and provide us some feedback?
Looking for some Networking Assistance?
Contact me directly at [email protected]
I will fix your problem ASAP.
Cheers,
Julio Carvajal Segura
http://laguiadelnetworking.com

Vlan and SSID not showing in AP Web Interface

We have a couple of APs that do not show the Vlans and SSIDs through the AP web interface. If you go to the SSID manager page in web interface, the page comes up but does not show any of the SSIDs configured. The same goes for Services - Vlan. That page comes up but does not show any Vlans configured. If you telnet to the APs, you see the listed mssid and all the SSID interfaces. The SSIDs on the APs are functional and working. This just makes it difficult to use the web interface for these APs. I have tried to compare running configs on APs where web interface is not showing this and on APs that it is showing but cannot see any differences.
Thanks.

Unsupported things are never documented. You can't possibly list all browsers that you don't support.
But if it's not mentionned clearly as supported then it means "it might work but we never tested with it".
Let us know how it goes with the 12.4.21
Nicolas
===
Don't forget to rate answers that you find useful

Vlan and physical interface of vlan shwing different utilizations

Puzzled???
Anyone know why the physical interface of the vlan and the vlan interface show differnt utilizations? For instance the physical interface shows 60% utilization and the vlan interface is double that.
Thanks in advance
Mike G.

as per my knowledge, the Subinterfaces are logical interfaces created on a hardware interface. These software-defined interfaces allow for segregation of traffic into separate logical channels on a single hardware interface as well as allowing for better utilization of the available bandwidth on the physical interface.
http://www.cisco.com/univercd/cc/td/doc/product/software/iosxr3/int_c3/hc3vlan.htm

Why i cant access asa 8.4 thruogh asdm from outside interface ???

hi all ,
plz help e why i cant access asa asdm from outside interface
my puclic ip on outisde is :
x.x.55.34
i changed portf of asdm to 65000 because i have portforward ,
i tried to connect to my ip thriuogh asdm bu :
x.x.55.34
x.x.55.34:65000
but no luck ,
it succed if i try to connect locally
here is my sh run command :
====================================================
ASA5505#
ASA5505# sh run
: Saved
ASA Version 8.4(2)
hostname ASA5505
enable password qsddsEGCCSH encrypted
passwd 2KFsdsdbNIdI.2KYOU encrypted
names
interface Ethernet0/0
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
switchport access vlan 2
interface Vlan1
nameif ins
security-level 100
ip address 10.66.12.1 255.255.255.0
interface Vlan2
nameif outside
security-level 50
ip address x.x.55.34 255.255.255.248
boot system disk0:/asa842-k8.bin
ftp mode passive
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network obj-0.0.0.0
host 0.0.0.0
object network localsubnet
subnet 10.66.12.0 255.255.255.0
description localsubnet
object network HTTP-Host
host 10.66.12.249
description web server
object network HTTPS-HOST
host 10.66.12.249
description Https
object network RDP-Host
host 10.66.12.122
description RDP host
object network citrix-host
host 10.66.12.249
description citrix
object service rdp
service tcp destination eq 3389
object service https
service tcp destination eq https
object service citrix
service tcp destination eq 2598
object service http
service tcp destination eq www
object network RDP1
host 10.66.12.249
object network HTTPS-Host
host 10.66.12.249
object network CITRIX-Host
host 10.66.12.249
object-group network RDP-REDIRECT
object-group network HTTP-REDIRECT
object-group network HTTPS-REDIRECT
object-group network CITRIX-ICA-HDX-REDIRECTION
object-group network CITRIX-ICA-SESSION-RELIABILITY-REDIRECTION
object-group service CITRIX-ICA-HDX
object-group service CITRIX-SR
object-group service RDP
object-group network MY-insideNET
network-object 10.66.12.0 255.255.255.0
access-list outside_in extended permit tcp any host 10.66.12.249 eq www
access-list outside_in extended permit tcp any host 10.66.12.249 eq https
access-list outside_in extended permit tcp any host 10.66.12.249 eq 2598
access-list outside_in extended permit tcp any host 10.66.12.122 eq 3389
access-list outside_in extended permit tcp any host 10.66.12.249 eq citrix-ica
access-list outside_in extended permit tcp any host x.x.55.34 eq 65000
access-list outside_in extended permit tcp any host x.x.55.34 eq https
access-list outside_in extended permit ip any any
pager lines 24
mtu ins 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-645.bin
no asdm history enable
arp timeout 14400
object network localsubnet
nat (ins,outside) dynamic interface
object network HTTP-Host
nat (ins,outside) static interface service tcp www www
object network RDP-Host
nat (ins,outside) static interface service tcp 3389 3389
object network HTTPS-Host
nat (ins,outside) static interface service tcp https https
object network CITRIX-Host
nat (ins,outside) static interface service tcp citrix-ica citrix-ica
access-group outside_in in interface outside
route outside 0.0.0.0 0.0.0.0 62.109.55.33 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication http console LOCAL
aaa authentication ssh console LOCAL
http server enable 65000
http 10.66.12.0 255.255.255.0 ins
http 0.0.0.0 0.0.0.0 outside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ca trustpoint _SmartCallHome_ServerCA
crl configure
crypto ca certificate chain _SmartCallHome_ServerCA
certificate ca 6ecc7aa5a7032009b8cebcf4e952d491
    308205ec 308204d4 a0030201 0202106e cc7aa5a7 032009b8 cebcf4e9 52d49130
    0d06092a 864886f7 0d010105 05003081 ca310b30 09060355 04061302 55533117
    30150603 55040a13 0e566572 69536967 6e2c2049 6e632e31 1f301d06 0355040b
    13165665 72695369 676e2054 72757374 204e6574 776f726b 313a3038 06035504
    0b133128 63292032 30303620 56657269 5369676e 2c20496e 632e202d 20466f72
    20617574 686f7269 7a656420 75736520 6f6e6c79 31453043 06035504 03133c56
    65726953 69676e20 436c6173 73203320 5075626c 69632050 72696d61 72792043
    65727469 66696361 74696f6e 20417574 686f7269 7479202d 20473530 1e170d31
    30303230 38303030 3030305a 170d3230 30323037 32333539 35395a30 81b5310b
    30090603 55040613 02555331 17301506 0355040a 130e5665 72695369 676e2c20
    496e632e 311f301d 06035504 0b131656 65726953 69676e20 54727573 74204e65
    74776f72 6b313b30 39060355 040b1332 5465726d 73206f66 20757365 20617420
    68747470 733a2f2f 7777772e 76657269 7369676e 2e636f6d 2f727061 20286329
    3130312f 302d0603 55040313 26566572 69536967 6e20436c 61737320 33205365
    63757265 20536572 76657220 4341202d 20473330 82012230 0d06092a 864886f7
    0d010101 05000382 010f0030 82010a02 82010100 b187841f c20c45f5 bcab2597
    a7ada23e 9cbaf6c1 39b88bca c2ac56c6 e5bb658e 444f4dce 6fed094a d4af4e10
    9c688b2e 957b899b 13cae234 34c1f35b f3497b62 83488174 d188786c 0253f9bc
    7f432657 5833833b 330a17b0 d04e9124 ad867d64 12dc744a 34a11d0a ea961d0b
    15fca34b 3bce6388 d0f82d0c 948610ca b69a3dca eb379c00 48358629 5078e845
    63cd1941 4ff595ec 7b98d4c4 71b350be 28b38fa0 b9539cf5 ca2c23a9 fd1406e8
    18b49ae8 3c6e81fd e4cd3536 b351d369 ec12ba56 6e6f9b57 c58b14e7 0ec79ced
    4a546ac9 4dc5bf11 b1ae1c67 81cb4455 33997f24 9b3f5345 7f861af3 3cfa6d7f
    81f5b84a d3f58537 1cb5a6d0 09e4187b 384efa0f 02030100 01a38201 df308201
    db303406 082b0601 05050701 01042830 26302406 082b0601 05050730 01861868
    7474703a 2f2f6f63 73702e76 65726973 69676e2e 636f6d30 12060355 1d130101
    ff040830 060101ff 02010030 70060355 1d200469 30673065 060b6086 480186f8
    45010717 03305630 2806082b 06010505 07020116 1c687474 70733a2f 2f777777
    2e766572 69736967 6e2e636f 6d2f6370 73302a06 082b0601 05050702 02301e1a
    1c687474 70733a2f 2f777777 2e766572 69736967 6e2e636f 6d2f7270 61303406
    03551d1f 042d302b 3029a027 a0258623 68747470 3a2f2f63 726c2e76 65726973
    69676e2e 636f6d2f 70636133 2d67352e 63726c30 0e060355 1d0f0101 ff040403
    02010630 6d06082b 06010505 07010c04 61305fa1 5da05b30 59305730 55160969
    6d616765 2f676966 3021301f 30070605 2b0e0302 1a04148f e5d31a86 ac8d8e6b
    c3cf806a d448182c 7b192e30 25162368 7474703a 2f2f6c6f 676f2e76 65726973
    69676e2e 636f6d2f 76736c6f 676f2e67 69663028 0603551d 11042130 1fa41d30
    1b311930 17060355 04031310 56657269 5369676e 4d504b49 2d322d36 301d0603
    551d0e04 1604140d 445c1653 44c1827e 1d20ab25 f40163d8 be79a530 1f060355
    1d230418 30168014 7fd365a7 c2ddecbb f03009f3 4339fa02 af333133 300d0609
    2a864886 f70d0101 05050003 82010100 0c8324ef ddc30cd9 589cfe36 b6eb8a80
    4bd1a3f7 9df3cc53 ef829ea3 a1e697c1 589d756c e01d1b4c fad1c12d 05c0ea6e
    b2227055 d9203340 3307c265 83fa8f43 379bea0e 9a6c70ee f69c803b d937f47a
    6decd018 7d494aca 99c71928 a2bed877 24f78526 866d8705 404167d1 273aeddc
    481d22cd 0b0b8bbc f4b17bfd b499a8e9 762ae11a 2d876e74 d388dd1e 22c6df16
    b62b8214 0a945cf2 50ecafce ff62370d ad65d306 4153ed02 14c8b558 28a1ace0
    5becb37f 954afb03 c8ad26db e6667812 4ad99f42 fbe198e6 42839b8f 8f6724e8
    6119b5dd cdb50b26 058ec36e c4c875b8 46cfe218 065ea9ae a8819a47 16de0c28
    6c2527b9 deb78458 c61f381e a4c4cb66
quit
telnet 0.0.0.0 0.0.0.0 outside
telnet timeout 5
ssh timeout 5
console timeout 0
management-access outside
dhcpd address 10.66.12.160-10.66.12.180 ins
dhcpd dns 212.112.166.22 212.112.166.18 interface ins
dhcpd enable ins
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
username test password P4ttSdddd3SV8TYp encrypted privilege 15
username ADMIN password 5dddd3ThngqY encrypted privilege 15
username drvirus password p03BtCddddryePSDf encrypted privilege 15
username cisco password edssdsdOAQcNEL encrypted privilege 15
prompt hostname context
call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DD
CEService
destination address email [email protected]
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:d41d8cd98f00b204e9800998ecf8427e
: end

For access over VPN you need:
management-access inside
and don't forget:
ssh inside
http inside
I'm guessing you forgot to grant ASDM (http/https) access to the IP addresses used by the VPN? Can you SSH? If not, that is your problem to solve first.

ASA 5505 getting dchp from the outside interface

Hi, i have this configuration on on the Asa client
: Savedz
: Written by enable_15 at 13:39:22.779 UTC Thu Aug 15 2013
ASA Version 8.2(5)
hostname Lakewood
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
interface Ethernet0/0
switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
interface Vlan1
nameif inside
security-level 100
ip address 172.100.2.1 255.255.255.0
interface Vlan2
nameif outside
security-level 0
ip address dhcp setroute
ftp mode passive
pager lines 24
logging asdm informational
mtu outside 1500
mtu inside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 172.100.2.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
dhcpd address 172.100.2.50-172.100.2.125 inside
dhcpd auto_config outside interface inside
dhcpd enable inside
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
service-policy global_policy global
prompt hostname context
this asa client is getting dhcp from another asa on another location, the asa on the other side cannot ping devices on the client side
this is the server asa
ASA Version 8.2(1)
name 50.66.169.176 OutsideWorld
name 172.100.2.0 Lakewood
interface Vlan1
nameif inside
security-level 100
ip address 172.100.1.254 255.255.255.0
interface Vlan2
nameif outside
security-level 0
ip address 50.66.202 255.255.255.248
interface Vlan3
shutdown
no forward interface Vlan1
nameif dmz
security-level 50
no ip address
interface Ethernet0/0
switchport access vlan 2
speed 100
duplex full
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
what type of configuration is this?
how can i get both sides to ping eachother and allow all the trafic?
thanks in advance.
Hi, i have this configuration on on the Asa client
: Savedz
: Written by enable_15 at 13:39:22.779 UTC Thu Aug 15 2013
ASA Version 8.2(5)
hostname Lakewood
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
interface Ethernet0/0
switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
interface Vlan1
nameif inside
security-level 100
ip address 172.100.2.1 255.255.255.0
interface Vlan2
nameif outside
security-level 0
ip address dhcp setroute
ftp mode passive
pager lines 24
logging asdm informational
mtu outside 1500
mtu inside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 172.100.2.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
dhcpd address 172.100.2.50-172.100.2.125 inside
dhcpd auto_config outside interface inside
dhcpd enable inside
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
service-policy global_policy global
prompt hostname context
this asa client is getting dhcp from another asa on another location, the asa on the other side cannot ping devices on the client side
this is the server asa
ASA Version 8.2(1)
name 50.66.169.176 OutsideWorld
name 172.100.2.0 Lakewood
interface Vlan1
nameif inside
security-level 100
ip address 172.100.1.254 255.255.255.0
interface Vlan2
nameif outside
security-level 0
ip address 50.66.202 255.255.255.248
interface Vlan3
shutdown
no forward interface Vlan1
nameif dmz
security-level 50
no ip address
interface Ethernet0/0
switchport access vlan 2
speed 100
duplex full
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
what type of configuration is this?
how can i get both sides to ping eachother and allow all the trafic?
thanks in advance.

Do you have a diagram of yourt setup and a more detailed description what you want to do?
The public interface of your main ASA looks like you are connecting to the internet. In that case, the IP address for the client has to come from the ISP and not from your main ASA.

Vlan and two outside interface

Similar Messages

Maybe you are looking for