WCCP Supported on Cat 3560?

Anyone know *first-hand* if WCCP is supported on Catalyst 3650s? and with what code revs?
Posted documentation on CCO seems to conflict both itself and with the CCO feature navigator -- I actually bought a pair of 3750s based on several published documents saying WCCP is supported -- only to find out that is not the case. There is even more documentation (including a how-to configuration doc) on enabling WCCP on a 3550 and 3650 switch -- yet the feature navigator says WCCP isn't supported on ANY Catalyst switches except 6500s.
Anyone know the deal for sure?
-Jeremy

Hi Jeremy
we do not support WCCP on either platform. It _is_ on the roadmap, but at this time, there is no ETA for supporting the feature. There are several mentions of WCCP support in the documentation, but they are in error, and documentation bugs have been filed to get this fixed.
HTH,
Bobby

Similar Messages

WAAS - WCCP redirect in Cat 3560

Are WAAS redirect ACLs supported on Catalyst 3560?
Thanks

You can only configure allow ACLs, no denys (except the deny all at the end).
Dan

WCCP redirect not working on Cat 3560

We have a 3560 running 12.2(37)SE1, IP services image.
Through debug, we can see WCCP communication betweeen the 3560 and our content engine (for web caching).
However, web traffic isn't being redirected to the CE at all. Instead, it goes straight out to the Internet.
Does anyone have the same issue? Has anyone got their 3560 to work w/ their WCCP products (web caching or WAAS)?

The 3560 does not support GRE redirection (layer3), so you need to use layer 2 redirection on your Content Engine for your 3560 to work fine with WCCP, also you need to use mask assignment since hash is non-supported as well.
Check this link:
http://www.cisco.com/en/US/products/hw/switches/ps5528/products_configuration_guide_chapter09186a008081db5b.html#wp1051427
Hope it helps!!

Mitel phone 802.1x with Cat 3560 and Cisco ACS5.2 problem

I am piloting an 802.1x implementation for a client who has Mitel IP Phones. I have setup the switch and ACS based on previous experience and a windows PC can authenticate onto the network OK. When I use a Mitel phone however, it seems to skip past the first 802.1x LCD message and goes straight to LLDP and DHCP discovery, which obviously fails. The phone are 5224s and the controller is on the original v10 release. I have cleared the 802.1x config on the phone and rebooting as per Mitel documentation which leads me to believe it should then prompt for a user/pass on next reboot. It does not do this.
I known the ACS is setup to support EAP-MD5 and I have tried all the various types of host modes including the default and Multi-Auth, Multi-Domain and none of them seem to make any difference. I have tried with and without a PC attached to the phone as well.
A wireshark shows the EAP identity request from the switch, and I see an EAP response from the phone, although it is slightly different to the PC's response. In the end the phone issues an EAP 4 failure message. So something in that EAP conversation doesnt seem to work. Does anybody have an experience of this?

A wireshark capture shows a difference in the EAP request message from a Cisco Cat 3560 (12.2.55) to the Mitel, compared to a HP Procurve to the Mitel which the Mitel responds to:
Cisco EAP Request trace:
Frame 17 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: Cisco_99:06:84 (00:1e:49:99:06:84), Dst: Mitel_2c:ad:3b (08:00:0f:2c:ad:3b)
    Destination: Mitel_2c:ad:3b (08:00:0f:2c:ad:3b)
    Source: Cisco_99:06:84 (00:1e:49:99:06:84)
    Type: 802.1X Authentication (0x888e)
    Trailer: 000000000000000000000000000000000000000000000000...
802.1X Authentication
   Version: 3
    Type: EAP Packet (0)
    Length: 5
    Extensible Authentication Protocol
        Code: Request (1)
        Id: 1
        Length: 5
        Type: Identity [RFC3748] (1)
HP EAP Request trace:
Frame 36 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: Procurve_03:b7:40 (00:1b:3f:03:b7:40), Dst: Mitel_42:f5:21 (08:00:0f:42:f5:21)
    Destination: Mitel_42:f5:21 (08:00:0f:42:f5:21)
    Source: Procurve_03:b7:40 (00:1b:3f:03:b7:40)
    Type: 802.1X Authentication (0x888e)
    Trailer: 000000000000000000000000000000000000000000000000...
802.1X Authentication
    Version: 1
    Type: EAP Packet (0)
    Length: 15
    Extensible Authentication Protocol
        Code: Request (1)
        Id: 1
        Length: 15
        Type: Identity [RFC3748] (1)
        Identity (10 bytes): User name:
The HP seems to be requesting a User name as a string in the Identity field, whcih the Mitel phone then responds with an EAP response packet with an identity of MITEL.
The other difference seems to be that a Version code of 3 is being used by the Catalyst but Version 1 by the HP and Mitel phone.
Any ideas anyone?

Does WCCP support traffic from different VLANs(mapped to VRFs)?

Hello,
I have the following scenario from the WAN to the Data Center and from the WAN to the Branch:
1. Router 2800/7200 with three (3) MPLS VRFs (VRF Lite)
2. Switch 3750 with three (3) WAN VLANs (one for each VRF) and three (3) LAN User Traffic VLANs (one for each ASA Context) and one WAE VLAN
3. WAE with WCCP enabled for one VLAN in the switch
4. ASA with three (3) Contexts
5. Three (3) Internal LANs (one for each Context)
In summary, there are three flows of traffic which are separated along the way from Branch to Data Center. WAEs are working for one VLAN(VRF1) and WCCP is enabled at the 3750 Switch to do the redirection (not in the router). The question is: does WCCP support traffic from different VLANs (similar to inline 802.1Q) and handle all three flows separate? If so, what should the configuration be at the switch and the WAE?
Thanks.

The VRF awareness for 12.4(T) is still probably 8-12 months out. VRF aware WCCP features are definitely in the pipeline, but nothing has been publically published on availability timelines.
It's now publically available on the forum... but , I've only found it on the 3750 and 3550 documentation.
at the 3750 you will need to place the redirect statement on each of the VLANs, ip wccp 61 redirect in
Kindly find here GRE Tunnel with VRF Configuration Example:
http://www.cisco.com/en/US/tech/tk436/tk428/technologies_configuration_example09186a00801e1294.shtml
I have gotten as far as the WAE registering the router:
"WCCP configuration for TCP Promiscuous service 61 and 62 succeeded.
WCCP configuration for TCP Promiscuous succeeded.Please remember to
configure WCCP service 61 and 62 on the corresponding router."
wae01#sh wccp router
Router Information for Service: TCP Promiscuous 61
Routers Configured and Seeing this Wide Area Engine(1)
Router Id Sent To Recv ID
0.0.0.0 209.1.1.1 0000022F
The router registers the WAE as a WCCP client:
router04#
"*Feb 4 18:56:09.892: %WCCP-5-SERVICEFOUND: Service 61 acquired on WCCP
client 209.1.1.2"
"*Feb 4 18:56:09.892: %WCCP-5-SERVICEFOUND: Service 62 acquired on WCCP
client 209.1.1.2"
The router however cannot figure out what its ID is and does not see
itself as a WCCP group router.
router04#sh ip wccp
Global WCCP information:
Router information:
Router Identifier: -not yet determined-
Protocol Version: 2.0
Service Identifier: 61
Number of Service Group Clients: 1
Number of Service Group Routers: 0
Total Packets s/w Redirected: 0
Process: 0
Fast: 0
CEF: 0
Redirect access-list: ACCELERATED-TRAFFIC
Total Packets Denied Redirect: 0
Total Packets Unassigned: 25957
Group access-list: -none-
Total Messages Denied to Group: 0
Total Authentication failures: 0
Total Bypassed Packets Received: 0
This is a short summary of important commands for working with VRF's.
View the VRF instances and the associated interfaces.
ml-mr-c6-gs#show ip vrf
Name Default RD Interfaces
blurvrf 100:2 Vlan215
Vlan326
tgvrf 100:1 Vlan132
Vlan325
TenGigabitEthernet1/1
ml-mr-c6-gs#
Show the routing table for a specific VRF.
ml-mr-c6-gs#show ip route vrf tgvrf
Routing Table: tgvrf
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external,
---More--
Gateway of last resort is 128.117.243.57 to network 0.0.0.0
O E2 192.52.106.0/24 [110/1] via 128.117.243.57, 1d19h, Vlan325
O E2 192.168.150.0/24 [110/160] via 128.117.243.57, 1d19h, Vlan325
172.17.0.0/29 is subnetted, 3 subnets
O E2 172.17.1.16 [110/0] via 128.117.243.57, 1d19h, Vlan325
O E2 172.17.1.8 [110/1] via 128.117.243.57, 1d19h, Vlan325
O E2 172.17.1.0 [110/1] via 128.117.243.57, 1d19h, Vlan325
--More--
Debugging should otherwise be similar to a regular switch or router.
Final Teragrid VRF Design and Diagrams
http://www.cisl.ucar.edu/nets/devices/routers/cisco/vrf/final.shtml
Teragrid Testbed Design
http://www.cisl.ucar.edu/nets/devices/routers/cisco/vrf/testbed.shtml
Cisco 4500 Series Switch Cisco IOS s/w config guide 12.1(20)EW
Configuring VRF-Lite
http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.1/20ew/configuration/guide/vrf.html
sachin garg

Wccp support on 1700

Hi,
I have a question on wccp support on 1700 router running ipbase image. once wccp ver 2 and service 61 and 62 are enabled on the router, it forms a service group with the engine and it sees the wae but once redirection 61 on the lan interface and 62 on the wan interface is enabled, no redirection takes place. the redirection doesnt occur and no traffic is redirected. What could be the problem. Does it have anything to do with the image running on the router?
Thanks.

Dotun,
What version of 12.3 and what version of WAAS? I would recommend looking at least IOS version 12.3(13) or 12.3(14)T5 depending on what train you are using. Do you mind posting your configs from the WAEs and router? That might help determine what is happening.
Also do a couple of commands on the wae:
sh wccp router
sh wccp wide
sh wccp gre
On the router do:
sh ip wccp
sh ip wccp 61 detail
sh ip wccp 62 detail
Thanks,
Dan

Cisco cat 3560 service-policy output problem

I have just use the 3560 to replace 3550 switchs, but the cat3560 does not support the command "service-policy output" which was supported by 3550,
we have already use this command in 3550 to control the network traffic.
so there somebody knows if there an schedule to implement this command?
Thank you very much.

"service-policy output" is not supported in 3560/3750 due to ASIC limitation. See if "srr-queue bandwidth limit" command will work for you
http://www.cisco.com/univercd/cc/td/doc/product/lan/cat3560/12225sed/scg/swqos.htm#wp1253412

WCCP redirection issues over 3560 E

Hello everybody
I have a WS-C3560E-24PD-S in my Data Center, in this switch I have vlan configuration and it is connected with a switch 4503 Core via a Port channel (4 interfases).
My problem is that the switch is not accepting any command related to the redirection (ip wccp version 2, ip wccp 61 (62), etc.)
I used this link:
http://www.cisco.com/en/US/docs/switches/lan/catalyst3750e_3560e/software/release/12.2_52_se/configuration/guide/swwccp.html#wp1031033
I updated the IOS to be the same as the version in the Link. So to this moment I've done everything the link has suggested and i'm not getting the switch to accept the commands.
Do you have any suggestion I can take?

Hi Rene,
The 3560-E (and 3750-E) models have a universal IOS image, and dependant on a license and a PAK code you'll either run IP Base or IP Services.
If you do a show version you'll probably see something like this :
License Level: ipbase Type: Default. No license found.
Next reboot license Level: ipbase
To run IP Services on a 3560-E you'll neeed to purchase an IP Services license (product number 3560E-IPSLCB-QTY - IP Services for 3560 E, upgrade from the IP Base Feature Set ) which have a list price of 4K US $ - so you don't have to buy a new switch ... just an expensive license :-(
In order to run WCCP on a CAT4503 with Sup IV - you'll only need IP Base (at least from version 12.2(31)SGx)
Best Regards
Finn

SNMPGET - how to retrieve dot1x information from cat-3560 ?

Hi all,
I have the following question:
how do I get the output of "sh dot1x all summary" cli command via SNMP?
#sh dot1x all summ
Interface       PAE     Client          Status
Gi0/34          AUTH    0113.d313.68d6 AUTHORIZED
Gi0/48          AUTH    0124.12f9.4f55 AUTHORIZED

Hi Leo,
Try the below OID , i am not sure if it is Implemented yet or not ::
Object     cpaePortOperVlanType
OID     1.3.6.1.4.1.9.9.220.1.1.1.8
Values     1 : other
2 : none
3 : guest
4 : authFail
MIB   CISCO-PAE-MIB ;   -   View Supporting Images this link will generate a new window
Description     "The type of the Vlan which is assigned to this port via IEEE-802.1x and related methods of authentication supported by the system.
A value of 'other' for this object indicates type of Vlan assigned to this port; via IEEE-802.1x authentication; is other than the ones specified by listed enumerations for this object.
A value of 'none' for this object indicates that there is no Vlan assigned to this port via IEEE-802.1x authentication. For such a case, corresponding value of cpaePortOperVlan object will be zero.
A value of 'guest' for this object indicates that Vlan assigned to this port; via IEEE-802.1x authentication;
is of type Guest Vlan and specified by the object cpaeGuestVlanNumber for this entry.
A value of 'authFail' for this object indicates that Vlan assigned to this port; via IEEE-802.1x authentication; is of type Auth-Fail Vlan and specified by the object cpaePortAuthFailVlan for this entry."
few other OID's which you might be interested in :
dot1xPaeSystemAuthControl
dot1xPaePortProtocolVersion
dot1xPaePortCapabilities
dot1xPaePortInitialize
dot1xPaePortReauthenticate
dot1xAuthPaeState
dot1xAuthBackendAuthState
dot1xAuthAdminControlledDirections
dot1xAuthOperControlledDirections
dot1xAuthAuthControlledPortStatus
dot1xAuthAuthControlledPortControl
dot1xAuthQuietPeriod
dot1xAuthTxPeriod
dot1xAuthSuppTimeout
dot1xAuthServerTimeout
dot1xAuthMaxReq
dot1xAuthReAuthPeriod
dot1xAuthReAuthEnabled
dot1xAuthKeyTxEnabled
dot1xAuthEapolFramesRx
dot1xAuthEapolFramesTx
dot1xAuthEapolStartFramesRx
dot1xAuthEapolLogoffFramesRx
dot1xAuthEapolRespIdFramesRx
dot1xAuthEapolRespFramesRx
dot1xAuthEapolReqIdFramesTx
dot1xAuthEapolReqFramesTx
dot1xAuthInvalidEapolFramesRx
dot1xAuthEapLengthErrorFramesRx
dot1xAuthLastEapolFrameVersion
dot1xAuthLastEapolFrameSource
Thnaks-
Afroz

AP1252-AG with Cat 3560 / Cat 3750

Hi All,
please advise, I am probably not the only one, but I have come to realise that 15.4W provided by switch ports on 3560/3570 catalysts is not sufficient to power up an AP1252-AG dual radio device. I have read the spec and it says that a dual radio AP requires 16.9W, but a single radio AP will consume/need 12.95W plus a little more depending on the ethernet cable length. As a test I physically removed one radio from the AP1252-AG and tried to power it up via poe port on switch. The AP powered up OK with just one radio module installed.
However the AP cannot be installed with one module removed, so my alternatives are to either power the AP with direct power supply or use the Power Injector which will provide enough power to start both radios.
I was wondering whether it is possible to have both radios installed 2.4/5.0 Ghz but have one disabled through the software, so that the AP will only effectively be running with one Radio Module (UP), but it will have two Radios installed physically.
I have tried this numerous times, when I try to use poe for the ap, it negotiates with the switch port that it need more power for the two radios, the switch can't provide it so it goes into low power mode.
I was hoping that by disabling one radio and then booting the AP it would only request enough power to feed 1 radio, the switch would be able to provide the requested amount and then the AP would work. But I cannot get this to work, Is it at all possible?

Well yes, if the clients are in range of the same AP, they will use the AP to communicate with one another. But if you have several APs, say one AP in one room and another AP in another room, then usually signal travels from wireless client 1 to AP 1 via the radio, then AP 1 forwards the packet over a cable to a switch that relays to the second AP, then the second AP relays the signal wirelessly to the second client. This system is used because usually APs would not use their radio to talk to each other, for many reasons.
In your case, if you have a controller, Aps need to talk to the controller, and the controller doesn't have any radio anyway, so you need cables to connect to your controller. If it is a 2100 controller, you can forget the switch and connect your APs to the controller.
If you have a 4400 series, you need a switch as APs cannot connect directly to 4400 controllers.
Cheers
Jerome

VSS support on cat 4500x

Hi,
when the VSS will be supported on Catalyst Supervisor Engine 7-E or 7-LE and on Catalyst 4500-X?
And does VSS will require Enterprise license ? or the IP base will be enaugh?
Tks
Paolo

Hi,
Is there any info on the VSS license for SUP7L-E ?
http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/release/note/OL_27990-01.html
Under Table 5 - Support by Image Type; VSS is listed as available on IP Base (SUP7E only) and a plain Yes under Enterprise Services
http://www.cisco.com/en/US/prod/collateral/switches/ps10902/ps12332/at_a_glance_c45-696645.pdf
Under Table 1 - Minimum License for VSS; IP Base or higher (7-E) or special license (7-LE and Catalyst 4500-X)
There appears to be no option on the CCO configuration tools to add VSS license on 4500R+E chasiss bundles with for example dual SUP7L-E and IP Base
How are you meant to purchase/license VSS on 4500E Chassis + SUP7L-E ?
thanks,
Sez

Will GLC-EX-SDM supported on Cisco 3560?

Hi,
I am looking for optics which can work for longer distances like 30-40kms using 1310 wavelength and we did see that there is a module for it ( GLC-EX-SDM= ). But I would like to know if I can use it in Cisco 3560 ? Do let me know what all switches or routers these modules will work ?
Thanks,
ramanan

Below is a link to compatibility information for pluggable optics modules.
COMPATIBILITY INFORMATION
I am surprised the GLC-EX-SMD is not included on the 3560, but sometimes it is a matter of available resources to test compatibility or an operating issue that was found during testing that would prevent its use (heat, power, EMI, etc.).
You could use the 1000BASE-ZX module (1550um), either GLC-ZX-SM or SFP-GE-Z, as these are included in the compatibility documents.
You would have to get an answer from the 3560 Product Manager to find out if it is on the roadmap to be added to the system.

CAT 3750 and WCCP?

Is WCCP supported in CAT 3750?

Is WCCP supported in CAT 3750?
Hi,
Yes WCCP is supported with release 12.2 (37) SE in IP Services.Check out the below link from cisco for more information
http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps5023/prod_qas09186a00801b0971.html
Hope to Help !!
Ganesh.H
Remember to rate the helpful post

ACE as cache engine for wccp redirection

Does anybody know if the ACE 4710 appliance supports WCCP acting as a web-cache engine? I am exausting all possible options, and then some, for deploying a new application networking environment. I just returned from ACE training last week and found myself ramping up to deploy a new ACE.
I have pretty much exhausted my options for topology. We discussed several different designs in class and I don't like any of them. I have some serious problems with using the ACE as a default-gateway for servers. That options is out due to how other "non application" traffic is handled. Traffic such as RDP from IT support staff, patching from SMS servers, virus dat updates, vulnerability scanning... it all routes to the ACE which has to have static routes... then clients hitting the application VIPs have to be natted so the ACE does not use the static routes and reply directly... it all becomes a very big problem over time.
Second and third options are one-armed and direct server return... both not suitable for my requirements.
Now... that leaves me with an option we currently have deployed. That is to use a distribution route-switch (Catalyst 4500 Sup-IV) in the middle. The Cat uses PBR to return http traffic from the web servers back to the ACE. All other traffic follows normal routing table.
Ok... that works perfect... except PBR is not supported in the Sup-6 engine. Unbelievable... I know. This is a major fly in the ointment for this new deployment.
Now... there is another protocol that is often used for redirection... WCCP. If the ACE were a wccp web-cache, the router could be configured to redirect ingress http to the ACE. But... the ACE would have to act as a web-cache engine and register with the Cat as a home-router.
I am sure this option is not an option... but it would be nice. The ACE 4710 appliance has the general processor to do it but it would have to be implemented in software. I'm running A3(1.0) and I cannot find anything related to wccp. Nothing in the command-reference.
If there are any Cisco developers interested in adding some killer funtionality... this would be it. Wccp can be done in layer-2 as well as layer-3. The Sup-6 supports layer-2 redirection. Since the ACE is generally layer-2 adjacent this would be rather easy to implement. Anyway... food for thought.

I just would like to mention that you could have ACE in bridge mode inserted between your servers and the gateway (4500).
All traffic will go through ACE but no need for nating and no statc routes (just one default route pointing to the 4500).
The only problems would be if you exceed the BW of the 4710 with all your traffic.
Regarding the WCCP support for the 4710 this is not currently in our roadmap.
Ask your cisco account team to introduce the request.
Thanks,
Gilles.

Catalyst 3560 Extended ACLs

I have a VoIP / QoS situation I just discovered on the Cat 3560's. In this case, a particular manufacturer's IP Phones do not tag CoS or DSCP. As such, I have defined extended ACL's/Policies on the Cat 3560 switches to detect and mark traffic from the IP Phones. My policies are designed to identify and mark Call Bearer with DSCP 46 and Call Control traffic with DSCP 26 based upon source address and UDP port. What I see however, is that all VoIP traffic is marked at DSCP 46, and nothing is marked at 26. (It's not so bad having control and bearer marked with DSCP EF, but I like to put call control in a different queue when possible.)
I am looking for confirmaton of the following theory. I suspect that the 3560's ((C3560-IPBASEK9-M), Version 12.2(25)SED) are not layer 4 aware, thus extended access lists function only as standard access lists - (even though the switch allows me to create an extended ACL). As such, my attempt to identify call bearer and call signalling based upon UDP port will not work.
Below is the ACL / Policy config. Note that on downstream routers, I only see DSCP 46 and never match DSCP 26 (af31). From the switch, using "sh mls qos interface statistics", I see no traffic with DSCP 26 at all (output attached).
I believe this is because the switch is only reading the layer 3 portion of the ACL. Since both ACL 101 and ACL 102 have the same layer 3 source adress, then all classified traffic will match class "IngressVoiceBearer" and get marked with 46.
access-list 101 remark Voice Bearer Signalling
access-list 101 permit udp 192.168.100.0 0.0.0.255 any eq 5004
access-list 102 remark Call Control Signalling (udp 5440-5445)
access-list 102 permit udp 192.168.100.0 0.0.0.255 any eq 5440
access-list 102 permit udp 192.168.100.0 0.0.0.255 any eq 5441
access-list 102 permit udp 192.168.100.0 0.0.0.255 any eq 5442
access-list 102 permit udp 192.168.100.0 0.0.0.255 any eq 5443
access-list 102 permit udp 192.168.100.0 0.0.0.255 any eq 5444
access-list 102 permit udp 192.168.100.0 0.0.0.255 any eq 5445
class-map match-any IngressCallControlSignalling
match access-group 102
class-map match-any IngressVoiceBearer
description All Inbound Voice Bearer traffic on UDP 5004
match access-group 101
policy-map IngressVoIP
class IngressVoiceBearer
set dscp ef
class IngressCallControlSignalling
set dscp af31
class class-default
set dscp default
Switch Output:
switch#sh mls qos int g0/1 statistics
GigabitEthernet0/1
dscp: outgoing
0 - 4 : 12359302 0 0 0 0
5 - 9 : 0 0 0 0 0
10 - 14 : 0 0 0 0 0
15 - 19 : 0 0 0 0 0
20 - 24 : 0 0 0 0 0
25 - 29 : 0 0 0 0 0
30 - 34 : 0 0 0 0 0
35 - 39 : 0 0 0 0 0
40 - 44 : 0 0 0 0 0
45 - 49 : 0 1837749 0 9716 0
50 - 54 : 0 0 0 0 0
55 - 59 : 0 0 0 0 0
60 - 64 : 0 0 0 0

Are the ports correct for the call control ACL? In the Cisco VoIP world we use an ACL like this for call control:
ip access-list extended VOICE-CONTROL
permit tcp any any range 2000 2002
permit tcp any range 2000 2002 any
permit tcp any any range 11000 11999
permit tcp any any range 1718 1720
permit udp any any range 1718 1719
permit udp any any range 2427 2428
permit tcp any any range 2443 2445
permit tcp any any range 5555 5599
But Cisco uses different protocols. Your ACL is configured correctly and the 3560 is supposed to support extended ACLs. Does your 3560 have an enhanced image or a standard image?
Are these Avaya phones? I have had to do software updates on Avaya phones to get them to behave correctly.
-Mark

WCCP Supported on Cat 3560?

Similar Messages

Maybe you are looking for