Cisco Switching/Routing :: 6509 Use Policy Based Routing To Redirect Http Traffic

May 29, 2012

We have a Catalyst 6509 switch, and we hope to use policy based routing to redirect http traffic to my proxy server, where I can find the configuration example?

View 11 Replies


ADVERTISEMENT

Cisco Switching/Routing :: 6509 Unable To Redirect Http Traffic

Mar 26, 2012

On a Catalyst 6509 switch I have configured wccp protocol in order to redirect the Http traffic to a Bluecoat SG8100. It was working fine until a new L3 interface implementation.Thereafter I was unable to redirect the http traffic due to an error reported from the Cat6509: [code] After some checks I supposed that the problem should be the UDP 2048 port connection between the Switch and the Bluecoat while the switch L3 port and the bluecoat are on the same Lan. A deep analysis found that the WCCP protocol seems to be as follow:

-Proxy address 10.64.28.240 to Switch Port 10.64.28.250 Here I Am
-Switch Port 10.64.28.250 to Proxy address 10.64.28.240 I See You
-Switch Port 10.66.0.251 to Proxy address 10.64.28.240 UDP 2048 packet (dropped by firewall)
 
It's strange to me that the first dialog is correctly handled by the correct Cat6509 interface while the UDP packets are flowing from another Vlan interface not configured with the WCCP and apparently not involved on the protocol.Last of all the WCCP is now disabled and unusable?

View 4 Replies View Related

Cisco Switching/Routing :: Policy Routing Based On Client Gateway (6509-E)

Feb 26, 2012

If client gateway = 192.168.64.9 then next-hop = 192.168.64.8 else use default-route 0.0.0.0
 
I know it's possible to do a route-map match ip-address ACL list. But is it possible to match on gateway?
 
Some info about hardware and config:

6509-E in VSS (IOS 12.2(17r)SX5) withVS-S720-10G supervisor.

All routes are static, IP for 192.168.64.9 is on SVI vlan.

View 3 Replies View Related

Cisco Switching/Routing :: Policy Based Routing On 6509

Mar 6, 2012

I need to setup my 6509 with PBR going to two different Firewalls. The 6509 has vlans and multiple serial interfaces. What/where do I install the policy-maps? I want to direct one of the vlans to one firewall and the other vlans and wan subnets to the other firewall.

View 26 Replies View Related

Cisco Switching/Routing :: HTTP Redirect Using 3750 Switch

Sep 16, 2012

I have tried search but found found anything for the 3750 switch about how to redirect HTTP, HTTPS & SMTP traffic to altenative gateway, than our standard gateway on our network, so here goes:
 
The network that need the HTTP, HTTPS and SMTP traffic redirect is 192.168.5.0/24 and should be redirect to 192.168.5.205 where as all other traffic need to be direct to 192.168.5.199.
 
Can the 3750 switch do this typo of refirect and if how?? I cannot find anything on the Cisco site stating how or even if it is possible! 

View 2 Replies View Related

Cisco Switching/Routing :: 3560 Policy Based Routing Verify-availability

Apr 19, 2012

Cisco 3560 does not support "set ip next-hop verify-availabilty". I need this command in my config. "set ip next-hop"  do not do the same job.

View 8 Replies View Related

Cisco Switching/Routing :: 1941 / Policy Based Routing With Two Default Routes

Jun 24, 2012

I have a 1941 router configured for Policy based routing with two ISPs.Two static default routes configured to point the gateways of respoective ISPs with same metric.But the problem is, packets are going throug the one ISP only while doing traceroute.
 
N/W connectivity:
 
ISP1----->                <----------------------> LAN1   
               |  Router |
ISP------->                <----------------------> LAN 2
 
Below is my configuration :
 
Current configuration : 5958 bytes
!
! Last configuration change at 05:18:56 UTC Mon Jun 25 2012
!
version 15.0
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption

[code]....

View 26 Replies View Related

Cisco Switching/Routing :: Policy Based Routing With 3750 Switches

Oct 17, 2011

I have a simple design with 3750. I configured a route-map which define a next hop. I defined this route-map on a policy on a vlan interface.When I test some ping and a debug ip policy and it seems that my policy never match.Is there any mechanism that prevent the switch from using PBR? I think of CEF .

View 5 Replies View Related

Cisco Switching/Routing :: How To Configure Policy Based Routing On 3750

Jan 28, 2013

In our datacenter we have a 3750 stack with IP base image.  I have enabled PBR and reloaded the switch.  Show sdm prefer says i am using default template.  The reason i want to use PBR is that we have 2 firewalls on the same work and want to be able to have granular control over which gateway out of the network they use but still be able to access all internal resouces accross wan and locally.

Created access list to identify traffic:
 
access-list 10 permit 10.2.3.59 (test workstation on vlan 3)
 
Created policy:
 
route-map TestASA permit 10
match ip address 10
set ip next-hop 10.2.0.3
 
Assigned policy to the user vlan3:
 
ip policy route-map TestASA
 
Results:It changed the default gateway to the above gateway but i could not access any resources on any other vlan, could not access resouces accross wan. 

View 16 Replies View Related

Cisco Switching/Routing :: Make Policy Based Routing On 3560?

Apr 17, 2012

I have tried to make policy based routing on Cisco 3560. I use ipservices ios (SW version 12.2.(50)SE3 and SW-IMAGE C3560-IPSERVICESK9-M)  For below configuration there is no problem and pbr is working.
 
“Access-list 100 permit ip host  1.1.1.1 host 2.2.2.2
Access-list 101 permit ip host  1.1.1.1 host 3.3.3.3
 Route-map pbr1  permit 10
Match ip address  100
Set ip next-hop verify-availability  1.1.1.2 1 track 11
 interface fasthethernet  0/1
ip policy route-map  pbr1”
 
But when i add another sequence to the "pbr1" with another sequence number  like that.
 
“Route-map pbr1 permit  11
Match ip address  101
Set ip next-hop verify-availability  1.1.1.3 1 track 12”
 
pbr is not working. Switch gives message "PLATFORM_PBR-3-UNSUPPORTTED_RMP:Route-map pbr1 not supported for Policy Based  Routing”"ip policy route-map pbr1" command not shown in the running config. And "show ip policy" output is blank.Configuration guide says you have insert many sequence to the route-map with the same name. And also this command is not in the unsupported command list.

View 16 Replies View Related

Cisco Switching/Routing :: Policy Based Routing And 3750 Switches?

Sep 5, 2012

I have a simple design with 3750.I configured a route-map which define a next hop.I defined this route-map on a policy on a vlan interface.When I test some ping and a debug ip policy and it seems that my policy never match.Is there any mechanism that prevent the switch from using PBR?

View 10 Replies View Related

Cisco Switching/Routing :: 9941 - Policy Based Routing With Firewall

May 10, 2012

I have problem while implementing policy based routing with a firewall. Let me explain in detail.
 
I have 2 remote site(Site A-small , Site B - Big) , Site B is connected with HQ with Tunnels 1 and 2 ,  Site B and Site A is connected with Tunnel 9941.
 
What I want is: Scenirio for Communication :
 
1)Site A--------->VPN Router Site B-----------> FW-------------->VPN Router Site B------------------>Central Site
2)Central Site--------->VPN Router Site B-----------> FW---------->VPN Router Site B-------------->Site A
3)Site B--------->FW-------------------->VPN Router Site B------>Central Site
4)Central Site--------->VPN Router Site B-------------------->FW------>Site B
5)Site A--------->VPN Router Site B-----------> Site B(no firewall)
6)Site B--------->VPN Router Site B-----------> Site A(no firewall)
 
Tunnel 1: 10.13.199.1-2
Tunnel 2: 10.13.199.1-2
Tunnel9941: 172.22.99.1-2
 
Site A LAN- 10.99.41.0/24
Site B LAN- 10.99.0.0/16
Central LAN - 10.18.0.0/16

View 4 Replies View Related

Cisco Switching/Routing :: Policy Based Routing Not Done In Hardware With 7604-S

Mar 11, 2012

I am having a problem with PBR done on a 7604-S router - It seems like it is not done in harware. I have an Iperf client and an Iperf server, and would like to test the performance of 7600 router for PBR, supervisor is RSP720-3C-G and used interface card is 7600-ES20-GE3C ESM20G.

I have read  numerous discussions about PBR that is supposed to happen in hardware when you use it with matching access-list and set ip next-hop.Although, when I start the iperf, the 7600 cpu is hitting the 80-90 % boundary, and transfer bandwidth can't go over 120-130 Mbit/s.The IP Policy is applied on an interface part of vrf ONE maybe this is casing the problem... ?

The diagram and configuration follows:
Configuration:
 
c7604#sh run
boot system flash disk0:c7600rsp72043-advipservicesk9-mz.122-33.SRE2.bin
!
ip vrf one
[Code]...

View 8 Replies View Related

Cisco Switching/Routing :: 1900 - Clear DF Bit And Policy Based Routing

Jan 8, 2012

I've been implementing a setup where a remote office has a Cisco 1900 router. There are 2 GRE/ IP SEC tunnels to the headquarters, 1 over public internet, 1 over a private cloud. Because of some MTU issues we have to clear the DF bit for some of the traffic, but we also want to use PBR to send https traffic over the "public internet" tunnel and the rest of the traffic over the "private cloud" tunnel. I'm able to clear the DF bit and to do the PBR with route-maps, but I'm not able to implement both functionality at the same time.

View 1 Replies View Related

Cisco Switching/Routing :: Policy Based Routing 3750

Dec 2, 2012

I have 2 ISP connected to Router A and Router B.Both the routers are connected to the core 3750 switch.. I want to send the traffic from the switch that goes to router A to router B..[code]

View 10 Replies View Related

Cisco Switching/Routing :: Policy Map Redirect Port 80 Switch 3750X

May 15, 2012

I would like to know if it possible to create a policy map in order to redirect the traffic ( 80 , http, 8080) to a proxy.
 
My current equipment its a 3750X using a IP Service License ,I was reviewing some options but i want to be sure before implement in production.

View 8 Replies View Related

Cisco Switching/Routing :: Asa 5520 Load Balancing Based Upon Http Or Https

Mar 5, 2012

I have a customer who wants his new ASA-5520 to load balance out-going traffic between 2 ISPs, fairly normal request. Now here's the twist. He wants to separate traffic based upon the protocol used, http to one ISP, https to the other.

View 3 Replies View Related

Cisco Switching/Routing :: Can 7600 Redirect Layer 4 Traffic

Dec 6, 2012

i want to to ask about redirecting in MLS 7600 .assume the user a has an ip x.x.x.xand that user requested url...i want to to redirect his request to url...the users that have to pay the monthly bills , i want to give thim an ips  and redirect all the http requests from this to a special local webpage .is is applicable to to it on router cisco 7600 ??or is it applicable on router 7206 npeg2 ? also i have siwtch 2960g.i dont want to do it by proxy server.

View 4 Replies View Related

Cisco Switching/Routing :: 3560 Redirect Internet Traffic

Nov 24, 2011

At one of my field offices I want to redirect internet traffic down a separate DSL connection instead of having it ride the T1 back to the main office then going out.  At this office I have a 2600 router, 3560 switch, with a Fortigate firewall in between DSL connection and LAN, Fa0/0 on router and firewall are both plugged in to switch.  I have seen posts that mention PBR or static routes which is the reccomended method for dealing with this? 

View 6 Replies View Related

Cisco Switching/Routing :: WCCP V2 - Unable To Redirect The HTTPS Traffic?

Jun 3, 2013

I am unable to redirect the HTTPS traffic on my cisco router with WCCP V2

View 2 Replies View Related

Cisco Switching/Routing :: Service Policy Input Not Working 6509 VSS

Jan 6, 2013

interface Vlan24
description Internal Wireless Internet
ip address 10.x.0.1 255.255.254.0

[Code]....

So, I am trying to limit the bandwidth used by this vlan. The service-policy output statement works, the service-policy input statement does not. My test is to get on that vlan and go to speedtest.net. My download speeds are about 3.5Mb/s, my upload speeds are about 20Mb/s.
 
it has something to do with this:
 
sh mls qos ip
QoS Summary [IPv4]:  (* - shared aggregates, Mod - switch module Sid - Switch Id)
Int  Sid Mod Dir  Class-map DSCP  Agg  Trust Fl   AgForward-By   AgPoliced-By

[Code].....

View 1 Replies View Related

Cisco Firewall :: Redirect HTTP / Ftp Traffic (ASA 5510)

Apr 25, 2011

i have the following scenario :
  
ISP1-------ASA 5510----------ISP2
                    |
                    |
                    |
                  LAN
 
i would like to use ISP2 for all http/https/ftp traffic.how could I force my ASA to set a different gateway for http/https/ftp traffic ?i have tried several solutions such as nat/pat rules, nothing seems to work.

View 7 Replies View Related

Cisco Switching/Routing :: 7200 - QoS Input Policy Doesn't Classify ICMP Packet Based On DSCP

Dec 20, 2011

I have made some test and i noticed that qos input policy does not classify the icmp packet based on their dscp.The "match dscp ef" or "match precedence 5" is not working only the "match protocol icmp" shows hits.
 
We need to classify the different icmp packets based on dscp ( TOS ) for measurement purpose.CISCO 7200, 12.4.25d and 12.4.20T have a same behavior.

View 6 Replies View Related

Cisco Switching/Routing :: 6509 User / Role Based Commands

Sep 8, 2012

I  want to give limited access to our first level support so that they can execute certain basic commands like, port vlan change, access port shut/no-shut on Cisco 6509 and 3750E switches IOS based. I want to restrict them to only few options so they can not make changes to uplink (TenGig) ports and can not issue reload command etc. We do not have TACACS. What is the best way to achieve this?

View 2 Replies View Related

Cisco WAN :: 4507 Redirect Web Traffic Via Policy

Jul 12, 2011

We have W2K3 domain with Catalyst 4507 routers.Client (laptop, tablet etc) needs to redirect web traffic (port 80) to a proxy server that listens on port 8080.
 
Before you ask, this cannot be done using a PAC file distributed via Group Policy or the like because these devices are not controlled by us. These devices are client owned and could be non-Microsoft OS and/or non-IE browser. The theory is to have a WiFi network where clients can bring whatever they like - iPad, Android, Windows, whatever it may be but we do not control them and therefore cannot send a PAC file to it. In the case on Android it does not have a proxy setting even if we could force something.
 
I've looked at Policy Based Routing which appears to do half the job. I can route a web request that is on port 80 to a new location ie our proxy server. But the problem is that it arrives on the same port 80 when the proxy server only listens on port 8080.

View 10 Replies View Related

Cisco WAN :: 3560 / Policy Based Routing With InterVLan Routing

Jan 14, 2011

I have 3560 with attached 3 networks, 172.16.1.0/24 172.16.2.0/24 and 172.16.4.0/24, all of them have a vlan interface, 172.16.1.254, 172.16.2.254, and 172.16.4.254, I have enabled intervlan routing with command ip routing and they have route beetwen each other. Now I want to create PBR and let them go to the internet from different gateways.

so i did 3 access list:

access-list 20 permit 172.16.1.0 0.0.0.255
access-list 10 permit 172.16.2.0 0.0.0.255
access-list 30 permit 172.16.4.0 0.0.0.255
and 3 pbr
route-map supnet permit 20 match ip address 10 set ip next-hop 172.16.2.3
route-map blade permit 20 match ip address 30 set ip next-hop 172.16.4.250
route-map main permit 20 match ip address 20 set ip next-hop 172.16.1.4
 
attached them to corresponding vlan interfaces and everything ok they have different gateways to internet but now I dont have routing beetwen them?

View 2 Replies View Related

Cisco Firewall :: Redirect Http And Https Traffic From ASA 5520 Via Squid?

Dec 20, 2010

Right now, in my network there is no proxy server and all users go straight through the ASA to access internet. I would like to put a squid with dansguardian (for web filtering). Steps in getting all http and https traffic from ASA go via my squid?

View 18 Replies View Related

Cisco Firewall :: ASA5510 - Redirect HTTP Traffic To Internal Proxy?

Feb 13, 2011

I am using ASA5510 and i want to know if it is possible to redirect http traffic to an internal proxy software. I explain : PC from the LAN use a internal proxy in their IE browser but some other PC doesn't use it.They are directy connected to the Internet using the Public IP from the WAN interface ( via NAT). Can we redirected this HTTP Traffic from the WAN interface to the Proxy in the LAN ?
 
Http Traffic will be routed like that : PC ->  WAN interface -> Proxy -> WAN interface -> Internet In fact,can we create a rule saying : All http traffic which doesn"t come from the IP Proxy must be redirected toward proxy.

View 6 Replies View Related

Cisco Switching/Routing :: 3750 Cannot Mark Http Traffic With DSCP

Mar 14, 2012

I am trying to mark http packets from a web server with DSCP ef, but when I am doing a traffic capture all http packets have tos 0x0.I am able to mark UDP and ICMP packets originated from this server, but not any TCP traffic.The web server is in VLAN 20This is my config mls qos ip access-list extended MARK-HTTP-ACL  permit tcp host 10.10.10.10 eq www. [code]

View 4 Replies View Related

Cisco Switching/Routing :: WS-4507R / Policy For Traffic Shaping?

Feb 18, 2012

I am trying to do policy on the interfaces of my switch WS-4507R, below the configuration I used to shap the traffic to 1 Mbps. However, when I tested it the traffic excceded the 1 Mbps.
 
class-map match-all 1MB
  match access-group name 1MB
!
policy-map 1MB
  class 1MB

[code]...

how I can restrict my bandwidth on the interface on 1 Mbps.

View 2 Replies View Related

Cisco Switching/Routing :: Traffic Policy Is Not Working On Catalyst 3750?

Jan 28, 2013

Unable to limit traffic on catalyst 3750 gigabit ports it has fiber modules,
 
I want to limit traffic 2mb per port
 
I have tried srr-queue and policier but it is not working and there is no ratelimit command under any interface, Applying policy to output is not supported of the interface
 
policy-map rate-limit
class class-default
police 2000000 8000 exceed-action drop
int gi1/0/3
service-policy input rate-limit 
 
still when I start download it goes to 10 mbps

View 12 Replies View Related

Cisco Switching/Routing :: Switch 3750 / Policy Inbound Traffic Per IP?

Mar 2, 2012

We are using Cisco 3750 switches in our environment as distribution switches.We currently use to police inbound traffic, but we need to find a solution to limit inbound traffic per IP.Something like this “Inbound traffic for each IP can be maximum 1 Mbps” This can be done having, one ACL and one class-map for each IP, but in my situation is not a practical solution, because we have more than 500 IP’s on that site.
 
Is any way to accomplish this without writing 500 ACLs and 500 class-map?

View 2 Replies View Related

Cisco Application :: Apply Policy Only On Specific Subnet / Port 443 Traffic Can Be Redirect And Rest

Feb 16, 2012

I am facing problem with ACE configuration. I want to redirect 443 traffic to my Proxy Server. But I am not able to do this. I want to redirect only subnet 192.168.80.0/24..Then only it is working but I dont have to have this policy to be applied on all the users only one subnet I want to have under HTTPS policy.
 
how can I apply the policy only on specific subnet so that port 443 traffic can be redirect and rest of all subnets can go direclty to Internet.

View 8 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved