Cisco Switching/Routing :: 2851 Servers Are Not Able To Reach Outside
Dec 9, 2012
I have a cisco 2851 router as the edge router, I have a 3750G and a 3560G switch and configured intervlan routing with four vlans, also connected to the switches a four servers and one has active directory and a dns server.i am able to ping from all te servers fine from different vlans and the servers are able to ping the edge router. the problem I am having is with DNS, in the edge router i have configured the isp's dns server address in ip name-server and i am able to reach the outside world.
the problem im having is the servers are not able to reach the outside, do i need to do something in the edge router to forward it to the 3750g or do i have to add my isp's dns servers on the 3750g with ip name-server.
I have one cisco 3750G-48 switch, one cisco 3560G-PS switch, Cisco UC520, cisco 2851 and cisco wireless access point.i have setup up intervlan routing between the two cisco switches and the uc520 with a total of four VLANS, the problem i'm having is with the 2851 router, I have created a trunk between the 3750 switch and the 2851 router. should I create subinterfaces on the 2851 router for the four vlans by doing gigabieethernet 0/0.1, 0/0.100 and so on or should I create BVI subinterfaces.
reason I ask is I created four vlans on the vtp server switch which is the 3750 and I connected the uc520 to the 3750 switch via a trunk interface and set up vtp client on the uc520, after I setup p the vtp on the uc520 the vlans were automatically created on the uc520 with each vlan having its own BVI interface.
So I am not sure how to configure the 2851 router to interact with the four vlans. also the 2851 router have two hwic 1adsl wics installed which will have two adsl connections coming in.how to set up the 2851.
I am a networking student and was playing around with a Cisco 2800 series router. Couldn't figure out the password or user name so was following these steps from this KB {URL}.
For Password and User Reset..... Although by the time I got to selecting a username and password the computer had went to sleep so I started over again. When I restarting this process I ejected the Flash memory told it to reset but failed to reinsert the flash card before it rebooting. Now in the terminal I get symbols instead of words. What can I do ?
I had these error messages on both my Cisco 2851 and on my Cisco Catalyst 6506.
On Cisco 2851: %SYS-SP-3-CPUHOG: Task is running for (2000)msecs, more than (2000)msecs (4/4),process = SEA write CF process. [code]...
And on 6506: Dec 27 15:20:55 MET: %SYS-SP-3-CPUHOG: Task is running for (2000)msecs, more than (2000)msecs (129/129),process = SEA write CF process.[ code]...
I have these IOS versions on my Cisco: Cisco 2851: 15.0(1)M4 Cisco 6506: 12.2(33)SXI
I have a Head Quarter and a remote site running over a OC3 circuit. [code]
On the HQ, I have a Cisco VXR7204 running IOS 12.4.15T(10) Advanced IP Serviceand the remote site is a Cisco 2851 also running IOS 12.4.15T(10) Advanced Ip Service. The HQ has a Riverbed Steelhead 5050H capable of delivering 100MbpsWCCP throughput. The remote site has a Riverbed Steelhead 1050H which can deliver 10Mbps WCCP throughput. At the HQ, the LAN network is 192.168.251.0/24.The Steelhead residing on the 192.168.251.0 network.At the remote site, the LAN network is 192.168.103.0/24 and 192.168.211.0/24.The Riverbed resides on the 192.168.103.0/24 network.
When a host on network 192.168.211.0/24 download a file from network192.168.251.0/24 network via http, the CPU on the Cisco 2851 goes to 99% utilization and that it stays there for the duration of the http session. There is very little traffic goes across the WAN whichis the way it should be but the CPU on the 2851 stays at constant at99% CPU utilization.
Why would WCCP consume so much CPU on the Cisco 2851? By the way, I am only getting about 5Mbps download instead of 90Mbps download, I think because of the high CPU on the router?
I can access the ACNS with this config. The issue is that it will not cache anything when I enable WCCP on both ends. I am unable to set the gateway to the IP (even when static) to the WAN interface IP with the error Network Unreachable by content engine. If I address it within the 192.168.2.X network and gateway to 2.1, it locks up when cache is enabled. 192.168.0.5 (the external wan int) is unreachable as a gateway.
I've tried the unnumbered ip on the internal interface but then the service module won't accept an IP stating that the router side must have an IP set.
I had WCCP attempting to cache but timing out on everything without caching a thing. I want/need to understand the IP routing before I get ahead of myself.
I'm running into what seems a basic ip routing config problem with a Catalyst 3750 (IP Base) switch. I have several VLANS configured on the switch with IP routing enabled, and the switch is connected to the inside interace of a new ASA 5520 as follows:
ASA5520 IP (Default gateway): 192.168.1.1Switchport Gi1/0/1 is configured as a routed port, IP address 192.168.1.3 255.255.255.0Example VLAN is VLAN 100, IP address 192.168.100.1 255.255.252.0 From the switch CLI, I can ping all VLAN addresses, as well as the ASA5520, and the client laptop I'm testing with from VLAN 100.
From the client laptop on VLAN 100, I can ping all switch interface and VLAN addresses (inter-VLAN routing is working), including 192.168.1.3, but I CANNOT ping the default gateway at 192.168.1.1.
Here is the relevant configuration information on the 3750:
! no aaa new-model switch 1 provision ws-c3750x-24 system mtu routing 1500
I have this strange problem with my Macbook pro, when I connect it to my cisco 2940 8 port switch then I can reach my ISP (websites eg. google.com) in like 2 minuttes, then something is happening on my router, because suddenly I can´t reach my ISP
This is what I have found out so far:
1. when I lose connection to my ISP then I can only ping internal ip addresses eg. another computer in my network
2. if I renew my ip address on the Macbook then it works again in 2 minutts, then the same happens again. This is my network setup:
Router -> Switch 1 -> Switch 2
I also know that it is not the Macbook, because it have got a new motherboard, and it have been reinstalled also if I use the Macbook on a other network then it works fine.
All my other computers ( windows and linux ) works fine, no problems.
To me it looks like it is a Nat and/or DNS problem, but I can´t fine out what it is.
I have a site that is very dense, but not high throughput. I have 4x48 port switches all 3560 and 1 2851 router. The switches are pretty much full to the brim but the site is never completly lit, they just like to move around a lot. However i wanted to provide this site with as much redundnace as possible. So my first thought was to build redundant pathing with the switches so that they could loose a switch and not have a single point of failure. So therefore I built a ring. SW1 to SW2, SW2 to SW3, SW3 to SW4, SW4 to SW1. To make this even more redundant against port hardware failure, i used two uplinks for each and built an etherchannel. is it good practice to use Etherchannel and Spanning Tree together?So i now have a good redundant LAN switching topology. I have multiple VLANs at the site so I am using Rapid-PVST. I did not set priorities on the switches as I don't think that is really truly necessary, but correct me if I am wrong!Ok so next step is to make sure that my WAN connection for all of these switches is redundant. I have a 2851 router, with 1 of the built in interfaces dedicated to our ethernet hand-off WAN connection (MPLS in this case using BGP routing). The other would be used as an uplink. I also got an additional card for the Router so that i can have redudant local LAN connections. I then built up some IRB bridges so that I could uplink the Router to SW1 and SW3. Is it good practice to use IRB Bridging on a Router to provide redundancy?So at this site i have the first part running, and it works pretty well but I have had 1 strage issue, which has to do with after a failure and re-convergence of spanning-tree, it seems that DHCP starts failing to work. I actually had to go into each of my switches make a dummy VLAN interface and put on helper-addresses to get them to work. They are not L3 switches (programatically speaking) so they should just forward the broadcast packet onto the router, which DOES have the helper-addresses programmed,Also at another site I have the bridge router setup configured, just without so many switches, and no etherchannel between the switches. This seems to work flawlessly, but the site is very small so performance issues would be difficult to spot since they are just thin-clients coming back to a Citrix server over a single T1.
We have recently started as Internet service provider in an open metropolitan.
We use a Cisco 3560G Layer 3 switch, where we have all our vlan where we have konfiguerat ex. Switch (config) # interface vlan 150, an interface for each VLAN capabilities such as int vlan 1 - 10/10 int vlan 2 to 30/10, int vlan 3 100/10 and so on. Our int vlan is configured as follows:
dhcp relay information trusted ip address <x.x.x.x> <x.x.x.x> ip helper-address <x.x.x.x> Ports (ex. int Gigabit Ethernet 0/1) are configured as follows: description Uplink switchport access vlan x
[Code].....
Now the problem; we have a customer in ex. vlan 3 who needs to access a server provided by another customer in the same vlan (vlan 3), and access to each other in the same vlan is not possible. You can access the server from any other vlan, but when it comes to access to another host in the same vlan, you will not reach it.
We suspect that the energy company has configured with pvlan isolated. If we use the command ip local-proxy-arp on each vlan, it works to reach each other, but it seems that our 3560 becomes overloaded when ip local-proxy-arp is enabled and it streaming and use IP telephony it doesn't work. The response time at ping is longer and the loss of packets increase with ip local-proxy-arp enabled. The other operators in the metropolitan also uses Cisco 3560G so the hardware should be sufficient.
We have also tried to add no split-horizon, but it made no difference. How do we get around this without negative consequences? Probably need something that makes you allow to send out the same interface that it came from, because it works as long as you are in another vlan.
The Cisco 1921 router has two routed adapters. One is GE0/0 which I am using for my WAN interface. It is working properly. The 2nd interface is GE0/1 which is being used as my internal adapter. It is running NAT. When I attempt to reach the internet it fails while checking the exit interface. Here is the report.
AttributeValueRouter ModelCISCO1921/K9Image Namec1900-universalk9-mz.SPA.151-3.T.binIOS Version15.1(3)THostnameBulldog Interface Details AttributeValueInterfaceGigabitEthernet0/1IP address192.168.1.1DescriptionNOC Link Test Activity Summary
I'm replacing our current router with an ASA 5510 running 8.4(3) and I'm having what I think are NAT issues.From the 192.168.0.0/24 subnet, I'm able to reach the outside world (via NAT/PAT) without any issues. However none of the internal subnets (e.g. 192.168.10.0/24) are able to. Packet-tracer shows no ACL issues.
I have a multiple Offices in my location , all my external users are connecting my site using Cisco Client to site VPN and accessing my 2 sites , All users are able to access my 2nd office servers which are in 10.10.0.x pool , I have a different vlan in that same location with 10.10.35.x series and users are not able to access this pool servers , I am not much familiar with Routing . i am using ASA 5520 firewall .
When i remove the login local from the line console i connect to console port and press enter it shows router prompt 2691Router> but i am unable to go to enable mode.If i telnet to router then i put username and pw then it goes straight to enable mode.
vty config is
line vty 0 4 exec-timeout 600 0 logging synchronous login local length 500 transport input telnet ssh escape-character 3
Any reasons why i can not go to enable mode by console?
I have been tasked with creating a VPN tunnel between our site and a vendor's support center. I successfully created the tunnel, which negotiates fine, but I can't seem to get the traffic flowing properly. The issue that I think I am having is that the vendor is using a public IP address for their remote internal network instead of a public one. At least that's what I think the problem is, but I'm probably wrong Here is a diagram of how the traffic should be flowing:
Office #3 Office #3 Office #1 Office #1 Vendor Vendor Desktop PC Gateway Gateway Firewall Public IP Private LAN 192.168.5.158 -> 192.168.5.1 -> EVPL -> 192.168.0.11 -> 192.168.0.5 -> Internet -> 68.x.x.x -> 192.68.48.0/22 Cisco 2851 Cisco 2851 ASA 5510 Cisco 7206
When I trace a route from the desktop PC to an IP address on the remote vendor end, instead of going to the ASA the traffic goes to another office. Here is what is happening to the traffic:
1 <1 ms <1 ms <1 ms 192.168.5.1 (Office #3 Gateway) 2 3 ms 3 ms 3 ms 172.20.254.5 (Office #3 EVPL VLAN to Office #2) 3 3 ms 3 ms 3 ms 192.168.1.14 (Office #2 Gateway) 4 4 ms 4 ms 4 ms 173.xxx.xxx.xxx (Public Internet)
The office with the desktop PC has no local internet access, so all internet traffic gets routed to office #2 (192.168.1.0) as shown above. I'm asuming this is happening because the vendor is using a public IP address instead of a private IP address for their network. The routers look for the shortest route, which would be the internet, and then route the traffic there. Instead they should be routing the traffic to office #1's ASA and then on to the remote vendor site. The 2851 routers are using EIGRP. I don't know if that is causing this to happen but I tried adding static routes and the traffic always goes to the same place. I can provide configurations on any of the devices mentioned, save for the vendor's.
we have tried to use the Cisco Hierarchical model as close as possible. we now have the need for 10 gig servers. we have a 7k, 5k, 6500, and 2960's in our network. we have some open 10 gig ports on our 5k. where is the best place to connect the 10gig servers. or is there a more preferred way to connect these new servers?a 10 gig blade for the 6500, the new 6001 switch?
We have 2 nexus 5K installed in our data centre recently and we are connecting new three servers to nexus switches. Each server has 2 10GB ports . 1 port of serverA is connected 5K1 and other port is connected 5K2 ( sameway other 2 server connected to Neuxs 5K1 and 5K2 Switches).So do we need to create each VPC with Portchannel (like VPC 1,2 and 3 ) for each server connection?
The two servers (red hat) use multicast for their heartbeat. Unrouted vlan 99 (only layer 2) is configured on the VTP Servers (6509).I have read this document [URL]
Switches 1 and 2 have IOS: c2960s-universalk9-mz.122-55.SE3.bin and the 6509: s72033-advipservicesk9_wan-mz.122-18.SXF17a.bin
IGMP snooping is enabled on the 2960 switches.In order for the heartbeat of the servers to work, I have tried these solutions:disable igmp snooping for vlan 99 on switch-1 & switch-2. (No additional action was taken on the 6509). This didn't work. I expected that the multicast traffic would be sent as broadcast throughout the network, but for some reason it didn't work.on switch-1 & switch-2 configured "ip igmp snooping vlan 99 querier" (no additional actions on 6509). Didn't work either.on switch-1 & switch-2 configured "ip igmp snooping vlan 99 mrouter interface gigabitEthernet 1/0/25" & "ip igmp snooping vlan 99 mrouter interface gigabitEthernet 1/0/26" for the two connections to the 6509. Again no actions taken on 6509. Didn't work. I want static mac entries on the switches to be my last resort, since the number of red hat servers on the network is going to increase and I want to give a more generic solution to the issue.
I have two N5K (5020) switches with NX-OS - 5.0(3)N2(1). These two switches form VPC domain: peer-link = 2*10Gb ports (1/17-18) and peer-keepalive link over managements ports.Also I have two HP servers with two 10 Gb ports on each server.Each server conected by one link to each N5K switch (1/9-10). N5K downlinks configured as access ports with LACP Active mode.There is only one VLAN (1).When "no shut" command entered on N5K access ports - ports going in "not connected" status, begin flap and then going in "linkFlapErrDisabled" state.In attach - "sh run" from N5K.
I need to implement LACP HP servers mostly DL 380 g7 with Intel based dual port with two types of Cisco equipment first scenario server connected to 3750x stack of 4 switch's .second scenario same server type connected to two Cisco Nexsus 5596 . My question regarding two type of connection.Is it possible to do active active ?Would it give fault tolerance ?With HP LACP implementation is there known issue or should i expect latency with such configuration?What is the maximal lag- channel group that is possible per type?
Need to Have both ISP to access internet/servers configure a Cisco 2911 router, It has two ISP one as primary 216.140.140.0, and secondary for backup as 216.150.150.0. I need to be able to access both the ISP's using the same interface Gi0/1. Since we have servers that have to have specific IP both when accessed and when accessing the internet so I used static Nat for the servers and Dynamic for all others. I did the following configuration but it does not work as i want it, if i unplug the Primary ISP from the unmanaged switch the secondary cant access the Internet or network.The secondary only works when the primary and secondary are both connected and have an equal cost Administrative distance, hence it is not available when the primary is down . Even though I can use a sub-interface instead of a secondary Ip address (which worked when I used it) I need to use the same interface using a unmanaged switch to which the outside interface of the router is connected and the two ISP's. Below is my configuration.
interface GigabitEthernet0/0 ip address 10.0.0.254 255.255.255.0 ip nat inside
I have forgot this technology name, but, I remember it can achive on between Nexus 7000s in two location, and also between two catalyst 6500.Can I ask if it can be done between one nexus and one catalyst 6500?
I have an 1841 and started to run into an issue which can be resolved but looking to see what you guys prefer to do in this situation. We allow users to connect the laptop via ethernet and wireless to our network at the same time as well as an iPad or any other wireless technology. With that said, for the most part each user has two IP's at any given point. The issue comes in is that I have a large amount of IP exclusions for servers, printers, switches, etc on the exclude list. I am starting to see that the 255 address are not enough to make a long story short. I am also using the 1841 to handle another range for the voice network, which has no isues. What is the best way to fix this issue? Can I run a virtual VLAN off that 1841 for everyone to use and then have the servers, switches, printers, etc on another one? I want to assume no, as both interfaces are used on the back of the 1841 for the two VLANS running now. Or is the only way to handle this with this device to say that as a policy you can only connect assigned company hardware to the network?
I have a setup where two servers are on the same network are plugged into a L3 switch. Off that switch there is a WAN Optimizer device which is inline going to the MPLS cloud. Also off that switch is an ASA firewall which leads to the Internet for the location. When the two servers communicate with each other i would think the traffic would only go through the L3 switch between the two servers. I am seeing traffic between these two servers hitting the WAN optimizer for some reason. I would think being that these two servers are on the same network the traffic between them would stay at Layer 2. routing is enabled on the switch because of other vlans on the network. What would cause the traffic between the two servers to leave the switch and go up to the optimizer? Below is a diagram that shows the basic setup.
I start configuring Cisco 2821 router for multicast . First short description and attached sheme explanation. Let we say I have small network with 100 users. One router and Cisco switch 3560. Two VLAN’s, one for data another for multicast. Data from internet works fine but now I want to connect multicast servers (or source of more multicast streams) from another subnet. Router have three interfaces.I expect there should be no problems with multicast configuration, but unfortunately it is not like I expect. What I did ?
My Data Center has one single core switch where is connected several servers, one port is the link to the router wan and other port is the link to the FW, my boss wants to install 2 nexus in order to replace the single switch. All my network has only one address, for example 192.168.10.0/24 if I connect two nexus 7010 in VPC and Domain, each nexus is going to has 2 modules with 48 port 10/100/1000 rj45 and i wan to connect servers directly to each nexus, with this figure i'm going to have a group of servers connected in two different nexus, Do they can have the same network 192.168.10.0/24 considering that the nexus are in the same vdc and vlan and have only one gateway for both groups? If the answer is positive, which nexus would be the gate way for that address, the primary or secondary? Or i must have a different address for both group of servers, i mean for example 192.168.10.0/24 and 192.168.12.0/24?thus each nexus would be the gateway for that new address?
To have two nexus connected by VPC in a Domain mean that one computer connected to one nexus can share the same address or vlan with other computer connected to the other nexus????
We have a server connected to a 3560 switch which in turn connects to 6500s. The gateway interface is on the 6500. We will be changing the 6500s so the mac address for the gateway will change, however the IP address will remain the same. As we change out the 6500s the uplink connections to the 3560 will go down. This will flush the old mac address from the 3560.When the 3560 removes a MAC address does it update servers so they have to relearn the correct MAC address?
last week I installed a new router (2911) in my network.We had to create two different VLANs for the new setup to work as wanted.I have a Windows 2008 R2 which is a Domain Controller for Active Directory on the ip address 192.168.0.195.That server (HP DL180 G6) has two NICs. One has the above IP address and the other one has 192.168.0.199.
On the other VLAN, I have a server, running the same OS, that I want to re-join, as it formerly was, the AD on the first server (192.168.0.195). This server has the new IP address 192.168.10.194.All these are connected to a Cisco switch SG 200-50 Gigabit Smart Switch. That one is connected to a Cisco 2911 router.
The problem is that, once the old 192.168.0.194 got to be 192.168.10.194, the 192.168.0.195 can't ping it anymore... At least not all the time... Sometime it works, sometimes not... Neither can't the 10.194 ping the 0.195 all the time. When one way works the other one doesn't... When one pings the other one successfully, the other one can't...
Before these servers were directly connected to the internet with two nics (Nightmare, I know). The Public IP on internet facing NIC and private ip on LAN facing nic. I'm in the process of changing this.I'm able to access internet from my vlans and also able to send emails but cannot receive emails on these servers.
My router congif is as follows:
Building configuration... Current configuration : 6234 bytes ! version 15.1 no service pad service tcp-keepalives-in service tcp-keepalives-out service timestamps debug datetime msec localtime show-timezone service timestamps log datetime msec localtime show-timezone
I am trying to create a port channel between HP servers (4 nic) and two nexus 2k. The server side its a single team with 803.2ad fault taulerence and on the nexus side it have created two port channel (port channel 1 for nexus 2k1 and port channel 2 for nexus 2k2) and made them ACTIVE (channel group mode active)
But when i add a another server on different ports and port channel them the same way as the above server on nexus 2k1 and nexus 2k2, the first server stops pinging. so i have to sht down the first port channel and reopen them - then it works, however it says NO NETWORK ACCESS on the servers (running windows 2008). the only way is to reboot the server i cant be doing this on a production network.
We have a setup of 2 Nexus 7000 chassis and several fexes (N2K-C2248TP-1GE). The fexes are connected through a port-channel to a single nexus 7000 (no vpc). (Fex 1 to Nexus 1, fex 2 to Nexus 2, fex 3 to nexus 1 etc).Are there guidelines on how to connect a server to those fexes.
I can see several possible scenario's at our site. I have drawn some scenario's on a design. I can't find detailed information on which setup is possible and which is not. The goal is to have as much redundancy as we can.When using scenario 1, do I configure an orphan port on the uplink to this server?
