Cisco Switching/Routing :: 4500 - Allow Only Specific Vendor Mac And Block Others
May 20, 2013
I have arequirement where in I need to allow only specific vendor made desktops/laptops to be connected to the switch and block the rest. Say I want only the HP made Laptops to be connected on the Network. and block all other vendors. such as dell, ibm etc.
I am having Catalyst 4500 switches in My network. i tried using the mac access list using the permit and deny statement and then mapping the access list to the vlan access map and then filter using the vlan id. But this doesnt work on cat 4500....the same I tested for 2950 switch and it works perfectly. are there any restrictions on 4500 or any extra configuration has to be done.
I'm using Cisco ACS 3.3 for RADIUS. How to do I make Vendor-Specific attribute available? (Attribute number 26, format: OctetString) The online help makes reference to it, but does not tell you how to make it available.
I have cisco3750 (core), 3550,3548, 2960, HP Procurve 2510 series, Extreme e250 series swiches running in my network. Now all are running by default. How can I deploy rstp here? Or which is the best loopdetection protocol is best here ? I have aroung 40 vlans . (not looking for PVST )
We have a 7609 in production network and I am trying to find out the SFP vendor plugged in module WS-X6724-SFP."show inventory raw" gives me the SN but not the vendor name. "show hw-module subslot 1/1" shows The indicated slot/subslot number is empty. Any commands which can show the SFP vendor?
I tried many different things to get the accurate answer for my issue. I wanted to know, will i face any connectivity or looping issue in the network if i connect Broacade SAN switch on a cisco 6500 switch.Also need to know to maintain a DATA DOMAIN which SAN switch is better? Cisco or other vendor.
How do I block specific domains (pandora.com, etc.) in the Sonicwall? It seems like this would happen in the CFS but do I need a subscription for this? I don't want to subscribe to Sonicwall's filtering list, I just want to block a couple specific domains.
I have an 1841 between my firewall and the ISP. Three interfaces - multilink to ISP, FA to my firewall, and FA to my inside network. I use the inside interface for configs aand snmp access, etc. Only my ISP-assigned fixed address block will get routed to the multilink by the ISP but I am nervous about the inside interface sitting on my LAN. I know I can remove it, but if I keep it there, how can I set up an ACL so that all traffic from the multilink interface is denied to the inside interface? I suppose another way to think about it that the inbound iface can only accept traffic from its own outside, not from the router.I think this is fairly simple but I don't want to knock down the traffic if I get it wrong.
I have Cisco ASA 8.0(5) and I need to block specific url to acees my https server in dmz ?I read about websence technology, but I think it's not free right? Also I read abotu policy inspection map's but in my case is HTTPS not http ..
How to configure the 825 to block inbound traffic from a specific internet IP address ?i noticed an IP and MAC that i don't recognize that is listed as a connection to my NAS's media server ...i blocked it in the NAS configuration page, but i don't want any unsolicited traffic into my network.
I'm using an ASA5505 (8.4(1)) and would like to block port 80 on a specific host in the LAN so machines in other remote LANs connected via VPN can't access this port on the host. Devices in the local LAN should have access to this port on the host. Here are the commands I'm using:
-access-list block_port extended deny tcp any host 10.20.10.20 eq 80 -access-list block_port extended permit ip any any -access-group block_port out interface inside
These commands are not working as I would expect them to. When I browse to http://10.20.10.20 from a remote machine over the VPN tunnel I am able to access the host web server.
I dont mean a website like facebook.com, but i want it to block an individual page,such as a profile page, yet still be able to access the rest of the site? Again i'm not after facebook settings etc, but i want to restrict access to certain webpages within Lan.
I have the Qwest/Actiontec Q1000 modem/router. I go to the ip address using my web-browser and open up advanced configurations -> access scheduler. I select a computer (and it automatically adds the MAC address) and then the days/times I want the internet to be accessible. However, when I click "add" (to add my internet allowance to the scheduler list) it just says 12:00 to 0:00, which is essentially permanently blocking the internet for that computer.
I have a WAG160Nv2 and I want to block specific external ip addresses from trying to get at our server that uses the WAG160Nv2 as an internet gateway. It's not immediately obvious if this can be done from looking through the config pages.
if the firewall rules in the RVL200 work for inter LAN routing as well as LAN<->WAN? I need 2 separate networks in a house, 1 for business 1 for family, and I want to only allow my IP on network 1 (family net,10.0.0.0/24) access to network 2 (business net 10.0.1.0/24). I want this as if I change rooms were a access point for business is not available I can use the home net and specific IP to access certain business net IPs. I saw you can turn inter vlan routing on or off, but it wasn't clear on firewall rules.know of a similar router in cost but with gige instead of 100Mb ports?
How to block a specific website with a specific time (office hours) for example "facebook" I want to block facebook within 8AM - 12Noon then 12-1 they can access the website, then 1-4 block again the website .
I was wondering if it was possible to block imessage to specific clients on the EA6500.These are the ips apple uses for imessage I need to create a firewall rule that blocks these ips from reaching a specific client on the network.
I have a Belkin N750 router which I purchased because the box said it had filtering options. I didn't realize that the filtering was only sites that Norton kept track of. There are certain adware sites I know about that I would like to filter. Possible with this router?
I have an ASA 5510, with Ethernet0 connected to Internet via a T1 line, Ethernet1 connected to LAN1, and Ethernet2 connected to LAN2. LAN1 & LAN2 are independant, but share the Internet connection, via the T1 line. On LAN2, I have another router that connects to the Internet, via a Comcast line. I wish to route some of the traffic on LAN2 (10.38.77.0) to the other Router, on LAN2 (10.38.77.12) (connected to the Comcast line). I have entered the following lines:
I am attempting to filter a specific host(s) from my OSPF routiing table on a ASA 5550 (ABR) using LSA prefix lists. However, when I look at the other routers in that area, I notice that ALL LSA type-3's are being removed (10 hosts are now missing from the routing table). I have verified the filter is working on the ABR, but I can't figure why ALL hosts/routes that were coming into the area are now being filtered instead of the specific one that I want to filter out.
Here is the config on the ABR:
prefix-list pdm_pl_000 seq 10 permit 206.253.180.137/32 ! ! router ospf 1 network 10.0.0.0 255.255.255.0 area 0 network 10.150.10.0 255.255.255.0 area 10 network 10.150.252.0 255.255.255.224 area 10
[code]....
The 206.253.180.137 host is actually coming from Area '3'. Am I doing something that is removing all type-3 LSA's?
Does the 4500 support VSS (Virtual Switching System) ? On the official product overview page it says: 1.6 Terabits capacity with Virtual Switching System (hardware-ready)What means Hardware ready ? Does it mean that it supports VSS in the same manner as the 6500 ? The reason I'm asking this question is that I didn't find any info on the Internet about this. We would like to upgrade our network by interconnecting the 2 sites with Layer 2 redundant links (Layer 2 extension), but I'd like to use the both links in a load-balancing manner, which can be a real pain in the *** with STP. The choice is between 4500 and 3750 stackable core switches. The 6500s are very expensive.
How to know 4500 SUP7-E's MIB ?Our customer use MS SCOM 2012 SP1 get the OID are 1.3.6.1.4.1.9.1.1286, but we use IOS MIB locator, we can not find this MIB id.
below are the IOS sh version information :
Cisco IOS Software, IOS-XE Software, Catalyst 4500 L3 Switch Software (cat4500e-UNIVERSAL-M), Version 03.02.00.SG RELEASE SOFTWARE (fc4) Technical Support: [URL] Copyright (c) 1986-2011 by Cisco Systems, Inc. Compiled Tue 26-Apr-11 18:09 by prod_rel_team
What is the correct way to lic VSS on a 4500 SUP7L-E ? url... Under Table 5 - Support by Image Type; VSS is listed as available on IP Base (SUP7E only) and a plain Yes under Enterprise Services, inferring that you need Enterprise Services lic on SUP7L-E to get VSS? url...Under Table 1 - Minimum License for VSS; IP Base or higher (7-E) or special license (7-LE and Catalyst 4500-X)Can find no option on CCO / configuration tools to list a 'special' VSS license for 4500R+E chasiss with dual SUP7L-E and IP Base.How are you meant to purchase/license VSS on 4500E Chassis + SUP7L-E ?
My 4500 core always in 60 % cpu utility , and when i run #sh proc cpu sorted i find that 55 29725041543795572214 0 39.43% 41.40% 41.39% 0 Cat4k Mgmt LoPri
Which mean that this process is the top one , and when i run #sh platform health i found that Stub-JobEventSchedul 10.00 15.98 10 64 100 500 20 17 12 29269:55 K2 CpuMan Review 30.00 35.60 30 48 100 500 49 46 32 52390:52
Those two process are the top and they already exceed their maximum rang and when i run #sh platform cpu packet statistics i can find that Packets Received by Packet Queue
How i can configure the SFP Ports on my 4500 SERIES CHASSIS with other SFP ports on the connecting switch. I want to connect 15 switches via GLC=SX=MM to my 4506E sfp card.
