Cisco Switching/Routing :: 6509 - Block All FTP Traffic On Port 21 From Servers In Network

Oct 3, 2012

I am attempting to block all FTP traffic on port 21 from the servers in my network, and only allow FTP from one server to go out.
I have created the following ACL
access-list 101 Permit ip any any
access-list 101 Permit 21 any
access-list 101 Deny 21 any any
and have applied it to my truck VPN that goes up to my firewall
int Vlanxxx
ip access-group 101 out
But when i test ftp is still allowed by all servers.

View 6 Replies


Cisco Switching/Routing :: 6509 ACL Block TCP Traffic One Way

Jul 14, 2010

Got servers in vlan 10 ip range and servers in vlan 20 ip range at the same layer 3 switch. (c6509 sup720)I would like to block TCP traffic initiated from Vlan 20 to Vlan 10. But the servers in Vlan 10 needs to be able to open an TCP connections to Vlan 20 did test with the ACL thats blocking (ack/established/syn) but unable to get it to work.Or it works both directions or is works non directions.

View 4 Replies View Related

Cisco Switching/Routing :: 6509 / Multicast Heartbeat On Servers

Feb 25, 2013

The two servers (red hat) use multicast for their heartbeat. Unrouted vlan 99 (only layer 2) is configured on the VTP Servers (6509).I have read this document [URL]
Switches 1 and 2 have IOS: c2960s-universalk9-mz.122-55.SE3.bin
and the 6509: s72033-advipservicesk9_wan-mz.122-18.SXF17a.bin
IGMP snooping is enabled on the 2960 switches.In order for the heartbeat of the servers to work, I have tried these solutions:disable igmp snooping for vlan 99 on switch-1 & switch-2. (No additional action was taken on the 6509). This didn't work. I expected that the multicast traffic would be sent as broadcast throughout the network, but for some reason it didn't work.on switch-1 & switch-2 configured "ip igmp snooping vlan 99 querier" (no additional actions on 6509). Didn't work either.on switch-1 & switch-2 configured "ip igmp snooping vlan 99 mrouter interface gigabitEthernet 1/0/25" & "ip igmp snooping vlan 99 mrouter interface gigabitEthernet 1/0/26" for the two connections to the 6509. Again no actions taken on 6509. Didn't work. I want static mac entries on the switches to be my last resort, since the number of red hat servers on the network is going to increase and I want to give a more generic solution to the issue.

View 10 Replies View Related

Cisco Switching/Routing :: Block LAN To LAN Traffic On 2960

Apr 16, 2013

Is there a way to block lan to lan traffic (except lan to gateway/gateway to lan traffic of course) on a Cisco 2960?

View 9 Replies View Related

Cisco Switching/Routing :: 6509 Use Policy Based Routing To Redirect Http Traffic

May 29, 2012

We have a Catalyst 6509 switch, and we hope to use policy based routing to redirect http traffic to my proxy server, where I can find the configuration example?

View 11 Replies View Related

Cisco Switching/Routing :: 2911 / Block All Traffic But Allow One Way Data Transfer?

Feb 5, 2013

I am trying to connect a Control network that can not have access to the Internet, or any other network for that matter, to my Admin network so that I can retrieve trend data about the plant that goes into a database. Right now the process is print information, hand jam into excel spreadsheet, print again, and hand jam into another excel spreadsheet on the other network. Reports are printed automatically once a day, but would like a simplified way of getting data from one network to the other without having to re-enter data several times. Current policies stipulate no USB drives connected to Control systems. Even if we could loosen that, personnel needed to transfer data is not available and going to each individual machine would take more time than current system.Now that background is laid, I have two 2911 ISR routers with EIGRP configured, each with a 4 port EHWIC card. The 3 L3 ports on the router are setup as follows: interface G0/1 to the internet, interface G0/2 to a wireless  back haul, and interface G0/0 for IT network. I then have 3 VLANs setup on the EHWICs for our Admin network. We will move the IT network to a VLAN on the remaining EHWIC port and connect the two 2911's through the G0/0 interface. I am going to have one computer on my Administration network dedicated to receiving the information and have a program that will take that data and import it to a database. I need to allow only that computer to receive traffic from the Control network and I need no traffic to flow back into the Control network. In other words I will transmit data from the control network to the admin computer using one protocol (TFTP more than likely) and block any other traffic coming out of and going into the Control network.

View 1 Replies View Related

Cisco Switching/Routing :: View IP Traffic On NX7000 Like On 6509 OIS

Dec 8, 2011

I would like to have a view of ip traffic on NX7000 as I am used on 6509 OIS, running the above commands: [code] Finding something like on 7000 ?

View 2 Replies View Related

Cisco Switching/Routing :: 6509 / Unicast NLB High Traffic?

Apr 27, 2013

i recently identified all switch ports in my network on 6509 core were Transmitting Mail server Exchange traffic that was destined for Unicast NLB cluster. and it was impacting various HOST machines NIC cards/performance.After reading this article, i moved NLB CAS servers behind a dedicated cisco Switch.
Now My core switch can learn mac address across its trunk port where CAS servers are connected on dedicated switch. but still i can see traffic Transmitting out to my all switch ports of same VLAN ( same as NLB VLAN).

View 5 Replies View Related

Cisco Switching/Routing :: Block Traffic Between Two Vlans On Cat3560C - Internet Access?

Aug 3, 2012

I have a Cisco C3560CG which is running C3560c405ex-UNIVERSALK9-M), Version 12.2(55)EX2.The switch has vlan 1 and vlan 50 configured, vlan 50 should have access to a limited number of host in vlan 1.The following acl has been applied on the inbound to vlan 50:
10 permit tcp host eq 137 138 139 445
20 permit udp host eq netbios-ns netbios-dgm netbios-ss 445
25 permit icmp host
26 permit ip host
30 permit ip host

I sure the above would work, but for some reason some of the packet counter are not incrementing but the traffic is being blocked. But I would like to see the counter increment.Also I have that I may beed to use VACL wouls this be the case?

View 26 Replies View Related

Cisco Switching/Routing :: Block / Permit Intra Vlan Traffic On 3750

Feb 21, 2013

I have One switch 3750 and many switch 2960 c.I use one ASA 5510 to reach emote branche site (vpn conexion).I use one router 1841 for internet conexion.Router 1841, ASA and catalyst 2960 are connected on the 3750.Default gateway of all user is ASA IP
I configured Vlan 3750 and it work.Now I need to implement security : permit/block specific traffic between vlan [code] From vlan 72 I cannot have remote access on computer in vlan 34 and I cannot ping computer in vlan 34.

View 1 Replies View Related

Cisco Switching/Routing :: L3 - Traffic Between Two Servers Leave Switch And Go Up To Optimizer

May 15, 2013

I have a setup where two servers are on the same network are plugged into a L3 switch.  Off that switch there is a WAN Optimizer device which is inline going to the MPLS cloud.  Also off that switch is an ASA firewall which leads to the Internet for the location.  When the two servers communicate with each other i would think the traffic would only go through the L3 switch between the two servers.  I am seeing traffic between these two servers hitting the WAN optimizer for some reason.  I would think being that these two servers are on the same network the traffic between them would stay at Layer 2.  routing is enabled on the switch because of other vlans on the network. What would cause the traffic between the two servers to leave the switch and go up to the optimizer?  Below is a diagram that shows the basic setup. 

View 6 Replies View Related

Cisco Switching/Routing :: 6509 Unable To Redirect Http Traffic

Mar 26, 2012

On a Catalyst 6509 switch I have configured wccp protocol in order to redirect the Http traffic to a Bluecoat SG8100. It was working fine until a new L3 interface implementation.Thereafter I was unable to redirect the http traffic due to an error reported from the Cat6509: [code] After some checks I supposed that the problem should be the UDP 2048 port connection between the Switch and the Bluecoat while the switch L3 port and the bluecoat are on the same Lan. A deep analysis found that the WCCP protocol seems to be as follow:

-Proxy address to Switch Port Here I Am
-Switch Port to Proxy address I See You
-Switch Port to Proxy address UDP 2048 packet (dropped by firewall)
It's strange to me that the first dialog is correctly handled by the correct Cat6509 interface while the UDP packets are flowing from another Vlan interface not configured with the WCCP and apparently not involved on the protocol.Last of all the WCCP is now disabled and unusable?

View 4 Replies View Related

Cisco Switching/Routing :: Traffic Flow Catalyst 6509 With WS-X6548-GE-TX

Nov 21, 2011

I'm receiving multicast traffic (400Mbps) on port 9/38 and sending it out on port gi9/48. I'm trying to achieve that traffic will stay within the card without using the switchfabric, 

View 2 Replies View Related

Cisco Switching/Routing :: 6509 QOS To Limit Bandwidth For Internet Traffic

Nov 5, 2012

We run a workers camp here and we currently have around 2500-3000 people using our 100MB internet pipe.  We are upgrading the pipe to 200MB soon but I still would like to limit how much bandwidth everyone is using.
We allow streaming media such as Netflix, youtube, apple TV and of course .So it gets full pretty fast.  We have QOS implemented although I wasn't here when it was done so I don't know a lot about it.  I would like to limit IPs to a certain amount of bandwidth. [code]

View 1 Replies View Related

Cisco Switching/Routing :: Capturing Traffic Flows From 3750 To 6509 Then To Netflow

Aug 6, 2012

I am aware that the 3750 switches are not able to support Netflows, so I have created a SPAN port and spanning traffic from a specific port. I would like to create a seperate VLAN and trunk the traffic from the SPAN port down to the 6509 switch and then capture all the traffic for that VLAN on the 6509.

View 4 Replies View Related

Cisco Switching/Routing :: Net-flow Not Reporting Egress Traffic On 6509 Vlan

Nov 27, 2011

We have a pair of 6509 working in a VSS configuration (IOS 12.2(33)SX5). The 6509s connect to a pair of ASAs (7.2 code) running in an Active/Standby setup. These ASAs in turn connect to routers going to remote sites. I have configured Netflow on the following VLANS,
VLAN 10 - Servers Vlan
VLAN 9 - Transit/ASA VLAN (connects ASAs to 6509s). All traffic originating from any VLAN on the 6509 crosses this VLAN in order to reach remote sites and vice versa
I configured the netflow source VLAN 11 although I am not collecing any netflow from it.Although I have been getting lots of Netflow info, I noticed that netflow for traffic originating from any user VLAN on the 6509s going to any remote site via TRANSIT/ASA VLAN(9) does not get reported, I even tested with 4 GB traffic but no result. Only reverse traffic (i.e. from remote site to user VLAN) is reported as it traverses the Transit VLAN (9).
I read somewhere that egress netflow is not supported in 6500, but isnt traffic originating from a user vlan to a remote site via the transit VLAN (9) considered ingress with respect to the transit VLAN (9)? I would like to know whether bidirectional Netflow is supported on 6500 VLANS. I have mimimum control on routers beyond the ASAs, and since these ASAs run 7.2 code netflow is not supported, and Monitoring this Transit Vlan gives me extremely useful info.
I do get netflow biderectional traffic from the Server Vlan 10, but I think it is correlated by the netflow collector from vlans 9 and 10. [code]

View 9 Replies View Related

Cisco Switching/Routing :: 3825 ISR - Traffic Route From Switch Port To Router Port

Jun 5, 2013

I'm fairly new to Cisco products am in the process of developing my network knowledge on a deeper level.  I have a 3825 with a HWIC-4ESW and I'm struggling to fully understand how the two "see" each other.  I've setup a V LAN with a layer 3 address on the HWIC and added the switch ports to it.  This seemed to allow devices connected to the switch ports to talk to the built-in router ports.  I thought this was all making sense until i applied an access-list to the router port.  It's a simple ACL i'm just using for testing and the only thing it does is blocks telnet from anywhere.  I know the ACL is setup properly because if I connect a device directly to the router port i cannot telnet to the port.  However, if i connect a device to one of the switch ports, i am able to telnet to the router port successfully. 

It seems that I'm missing something with how traffic flows from the switch port to the router ports and how the two "see" each other. 

View 2 Replies View Related

Cisco Switching/Routing :: To Manage LAN Users And Database Servers Traffic On Single 2960

Sep 6, 2012

For my Lan, I have created two Vlan; Vlan 10 = for Users   and    Vlan 20 = For Database Servers,There are 15 Lan computer/laptop and 5 SQL database server (Dell Server) connected through same 24 port cisco 2960 switch. Means, 15 + 5 port occupied.
I have applied access list on cisco switch to restrict communication between vlan 10 and vlan 20.But My main purpose to create two Vlan is not for any kind of communication or restriction. My main Purpose is that Users traffic do not distrub or choke or affect the Database servers. then what will i need to do for that is VLAN Concept is sufficient for my concern  OR  I will need to buy seperate Cisco Switch to connect 5 database servers   OR  Else ?

View 9 Replies View Related

Cisco Switching/Routing :: How To Edit Port On 6509

May 15, 2013

I am very new to configuring ports on a switch. My boss usually does the port configurations but I am starting to learn some of the basic commands. The commands I know how to do are; close a port by typing config t, int gi0/port# and typing shut. I know how to enable a port, but how can I add info to a port or copy settings from one port to another?

We have some ports that are configured for 192.168 addresses but most are 10.128 addresses. I need to configure a certain port to be able to receive 192.168 addresses.

View 2 Replies View Related

Cisco Switching/Routing :: 3550 / Access List - Block One Ip Or Port

Jan 9, 2012

I have a layer 3 switch, 3550.I have several vlans on there just for playing around with. One of the vlans, has a vonage linksys box attached to it with a UK number attached. From time to time telemarketers call at 03:00 in the morning, this as I'm sure you can imagine is not much fun. The linksys box gets as it's ip.The switch is connected to a non cisco router at
interface FastEthernet0/24
no switchport
ip address
I was thinking a time based access list would work best I have tried several variations but the phone still rings. I have tried access-list 1 deny host permit ..... and more extensive lists but the phone still rings. I have not applied the time-range yet, so that's not the problem.I have applied the list to the vlan interface and to fa0/24 but it's not working.

View 3 Replies View Related

Cisco Switching/Routing :: 6509 Trunk To Port Channel

Apr 22, 2012

I have 2 Cisco 6509 switches linked together via single Fibre as a trunk.I want to change this to a port channel where I will add another 3 fibre ports to the port channel but what order do I do this to minimise any disruption.

1-Configure PortChannel and add the 3 new ports, this will bring up the Port Channel but what effect will this have on traffic currently going over the single Trunk link? Will spanning tree go mad, how will switches react?

2-Convert existing Trunk link to Portchannel then add in new ports to PortChannel, I guess in doing this there will be a small hit on traffic as it changes to a port channel.

View 2 Replies View Related

Cisco Switching/Routing :: 6509-E VSS 10gb Port Count?

Jan 15, 2012

Created two 6509s as VSS with just one 10gb connection?I know it is recommended to use both the 10gb connections on the sup-720 from below configuration guide
Information about VSL Topology  
A VSS contains two chassis that communicate using the VSL, which is a  special port group. Configure both of the 10-Gigabit Ethernet ports on  the supervisor engines as VSL ports.
But will the VSS come up if I use just the one?

View 2 Replies View Related

Cisco Switching/Routing :: Use Sub-interface On Routed Port On 6509

Mar 14, 2012

We are looking for a solution that to use Sub-interface on a routed port on 6509, instead of using a SVI on it.Are there any different when using Sub-interface?

View 3 Replies View Related

How Does Firewall Block Or Filter Traffic On Specific Port Or IP Address

Nov 15, 2011

How does a firewall block or filter traffic on a specific port or IP address?

View 1 Replies View Related

Cisco Switching/Routing :: Create A Port Channel Between HP Servers (4 Nic) And Two Nexus 2k?

May 9, 2012

I am trying to create a port channel between HP servers (4 nic) and two nexus 2k.  The server side its a single team with 803.2ad fault taulerence and on the nexus side it have created two port channel (port channel 1 for nexus 2k1 and port channel 2 for nexus 2k2) and made them ACTIVE (channel group mode active)
But when i add a another server on different ports and port channel them the same way as the above server on nexus 2k1 and nexus 2k2, the first server stops pinging. so i have to sht down the first port channel and reopen them - then it works, however it says NO NETWORK ACCESS on the servers (running windows 2008). the only way is to reboot the server  i cant be doing this on a production network.

View 6 Replies View Related

Cisco Switching/Routing :: 6509 Vlan Flapping Between Port-channels

Mar 10, 2012

We have a pair Cisco 6509 switch in which 2 * 48 Port 1G line cards and 1 * 16 Port 10G line Card, FWSM and Sup 720 are installed.We have Cisco UCS and HP Blade servers.Cisco UCS servers are connected to Cisco 6509 switch using Fabric Interconnect, and HP Servers are directly connected to core switches.Recently the team made many changes in the network. Upgraded the IOS in Cisco 6509 switch, Configured Port profiling , MAC Pinning , HBA Cards to UCS / Nexus 1000V Infrastructure. After this change they lost the connectivity to UCS and HP Serers. Every tower is checking at their end.
The Network Team has reverted back the core switch with old IOS , but still the problem persisit.I could only see the following error log in the core switch. There are two port-channels one between core 1 and core 2. The other is between core switch and FWSM module. [code]

View 2 Replies View Related

Cisco Switching/Routing :: Set Port Vlan On 6509 Running In Vtp Client Mode

Jan 14, 2013

I'm working at a company that has several 6509 switches running CatOS.  They have two of the 6509's running in vtp server mode and the rest as clients.  I set up a new vlan from one of the vtp servers and it propagated out.  The problem comes when I try to assign a port on one of the vtp clients to this new vlan.  It gives me an error that the switch must be in vtp server mode to add/delete vlans.  I'm not trying to add/or delete a vlan just trying to add a port into an existing vlan.  I'm hesitant to put the switch in vtp server mode.  Is this a CatOS thing or is there a specific command to accomplish this?             

View 5 Replies View Related

Cisco Switching/Routing :: 6509 - Can't Change Native Vlan On Trunk Port?

Jun 6, 2012

I have several closets with Cisco 3560 on the edge that I'd like to change the vlan that's used for the management vlan on each. In the core I have a Cisco 6509 with Sup720's.
I'd like to do this by changing the native vlan on the trunk port on the core 6509 interface that connects to the 3560. and leave the management vlan on the 3560 as vlan 1.
Seems trivial but what I tried didn't work and I didn't have the window to troubleshoot. I'll paste the simplified configs for  the interfaces  below
6509 configs:
interface Vlan50ip address!interface FastEthernet


View 5 Replies View Related

Cisco Switching/Routing :: 6509-E Switches Interconnected On Layer 3 Port Channel

Oct 3, 2012

We are currently designing  Layer 3 to the edge EIGRP solution  for our customers. The network is a hybrid of collapsed  core (Core to access) as well as a three layer design (Core/Distro/Access) for connectivity to the Data Centre, Internet, Wireless Blocks etc.The  core of the network contains two 6509-E switches interconnected on a  Layer 3 Port channel (no VSS). Access Layer switches (3750-X series running Stackwiseplus protocol)  connect to the core switches over p2p routed links and Distribution layer switches (3750X stackwiseplus) provide connectivity to the  Data centre, Internet, wireless blocks etc.
The access and distribution switch stacks(Cisco 3750-X) are set up with two or three member switches with uplinks multihomed to the primary and secondary core switch with each uplink included in EIGRP. In each of the stacks, one of the switches controls the operation of the stack, which will be  the stack master.As the Cisco Stackwise architecture is not SSO-capable but NSF aware, all Layer 3 fuctions must be re-established during a master switch outage. To minimize control plane impact and improve Layer3 convergence, uplinks should be diverse and originate from the member switches instead of the Master switches in the respective stack. This is as per Cisco recommended design solution.The above solution can be setup if there are more than two switches in the stack. i.e. uplinks are configured on the backup member switch modules.
1.But what about stack with two switches..Which switch should be set up as the Master for a two member stack with uplinks to the core primary and secondary from each switch(Master and Backup)
2. For Layer 3 routing, does the routing takes precedene over switch failures? Say for eg. In a two member stack, the master switch with uplink to primary fails, does EIGRP provide a fast convergence to route traffic via backup secondary and does not wait for the control plane on the switch stack to converge? All the access to core links will be set up for ECMP.

View 3 Replies View Related

Cisco Switching/Routing :: 6509 / WS-X6704-10GE Module And Port Status?

Dec 7, 2011

We have two 6509 switches with one WS-X6704-10GE module in each of them. There is an optical cable between the two switches plugged in  WS-X6704-10GE module on both sides. When you shut down the port on one side the other port still stays as up and you need phisycally to unplug the cable to have it down. The same behaviour is seen no matter on which of the two switches you shut down the port, the opposite one always stays as up and only removal of the cable makes it go down.
The ports are configured quite simply:
interface TenGigabitEthernet1/1
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 1-10
no ip address
udld port
The IOS version is 12.2(18)SXF8

View 2 Replies View Related

Cisco Switching/Routing :: Limit For Creation Of Port Chanel In Core Switch 6509 And 6513

Feb 20, 2012

How much is the limit for the creation of PortChanel in a Core Switch 6509 and 6513?Is there a limitation byu hardware?

View 7 Replies View Related

Cisco Switching/Routing :: 6509 / Layer 3 Port Channel Between Sites Connected Over Dark Fiber?

May 21, 2013

Has anyone configured Layer 3 port channel on Cisco 6509 switches which are connected over dark fiber between two buildings?

View 3 Replies View Related

Cisco AAA/Identity/Nac :: 6509 - Detect And Block Unauthorized Devices / Users In Network

Sep 25, 2012

we have Cisco 6509 as a access switch in our network. Each user has an IP phone and a computer. we are going to implement 802.1X for end users by next month. I need to check all the users activity in the network like if someone plug an access point to the network or a router.I just checked Cisco NAC and how to detect those activities on the network.
I need to get more details on Cisco NAC or other products for that purpose. also what is the difference between Cisco NAC and application like Microsoft TMG?
is it agent less or I have to install something on computers? is it working as a default router for users computers?

View 1 Replies View Related

Copyrights 2005-15, All rights reserved