Cisco Switching/Routing :: 871 IP Routes Based On Domains
Apr 9, 2012
I would like to configure few routings on my Cisco router 871 in order to allow my employees to have access only to specific websites.However, since some websites have dynamic IPs propably the route that I will create will not work.
My question is, can I configure a route or is there any other way to configure this permission based on the hostname/domain? For example, if I want to permit access to this website www.surveymonkey.com (75.98.93.51) instead of configuring:
ip route 75.98.93.51 255.255.255.255 192.168.10.250
is there any way to configure based on the url.. in order to be able to recognise this host correctly??
I have a 1941 router configured for Policy based routing with two ISPs.Two static default routes configured to point the gateways of respoective ISPs with same metric.But the problem is, packets are going throug the one ISP only while doing traceroute.
N/W connectivity:
ISP1-----> <----------------------> LAN1 | Router | ISP-------> <----------------------> LAN 2
Below is my configuration :
Current configuration : 5958 bytes ! ! Last configuration change at 05:18:56 UTC Mon Jun 25 2012 ! version 15.0 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption
I have 2 connections a single T1 for voip traffic only and a DSL line for data traffic.the dsl was migrated to a 2811 with out any issues now comes the time to move the T1 over.
on the T1 side I am able to ping the WAN router and the LAN router IP address but nothing behind it.
currently this is the only statment on the router: ip route 0.0.0.0 0.0.0.0 Dialer1
as a quick a dirty to remove the above i tried: no ip route 0.0.0.0 0.0.0.0 Dialer1 ip route 66.55.110.0 255.255.255.0 Dialer1
but the DSL side dropped. we have a 66.55.110.152/29
for the T1 i would use the following statement.. we have a 209.98.53.192/27
I have a pair of N5K's, down stream from them are from Fabric Interconnects and a UCS chassis. Upstream is a stack of 3750's then ASA5510's.
I am trying to backup the config to our TFTP server and I am getting 'no route to host'.. I tried to add a route, and found that N5K uses VRF's for routing?? .. After some looking I see there are two base VRF's 'management' and 'default'.. the management VRF has a default gateway entry and a single interface member (mgmt0).. when I look at the default VRF .. there are no interface members or routing entries.. Ok, I can handle that just add some interfaces and add a default gateway. Then I get lost:
I'm able to access the UCS manager..... so how the heck is that even possible if there's no gateway defined anywhere (or maybe I'm missing something?). My theory was: add all other ports but mgmt0 to the default VRF, and have the default gateway point out of the uplinks (a vPC).. but wasn't sure how that would affect anything and mainly just wanted to know how I was able to access the UCS manager in light of the fact that there is no default gateway anywhere that I could see...
However, the 6509 IOS only provides the option to track an interface. Is this a feature that's available in later IOS versions?
Is there another way to track these routes? The subnets are used for WAN links at a HQ and DR site and we are doing a specific PBR (sending all http/https traffic) using these subnets. If that WAN link goes down, we want to be able to utilize a backup WAN link to support that traffic.
Im new to cisco routes, Im traing to configure a 1711 routes with a dsl 2wire routes, my problem is that Im able to ping anywhere in the routes, but when Im on my computer I can only ping the interfaces on the router but no the 2wire route that gives me access to the internet.
My computer is getting ip addres 192.168.200.100 when I ping th 192.168.1.76 is fine, but when I try to ping the 192.168.1.254 does not work, Im assuming the cisco has activated a dinamic route from .76 to .254, but it is not working, why?
Here is the router configuration
Router#show runBuilding configuration... Current configuration : 1183 bytes!version 12.3service timestamps debug datetime msecservice timestamps log datetime msecno service password-encryption!hostname Router!boot-start-markerboot-end-marker!!no aaa new-model!resource policy!memory-size iomem 25ip subnet-zero!!no ip dhcp [Code]....
6500 - version (s72033_rp-ENTSERVICESK9_WAN-M), Version 12.2(18)SXF17a.I have two ISP's. I have created two defaults as follow & secondary route does not work. [code] After disabling the interface to ISP1, backup routes does not work. [code]
I have a scenario which is fairly common - certain servers are accessed from the internet via a Load Balancer, and since seeing true client IP is a requirement, the return traffic path must go back through the load balancer. However, I do not want to route all traffic via the load balancer for obvious performance reasons. Internal traffic should be routed directly by the Layer 3 switch, which has a default route of a Firewall.
My plan is to use a VRF for the load balancer and any applicable servers, which works fine. But now I need to join the VRF's routing table with the switch's GRT (global routing table) so that internal traffic works. What is the best way to do this? For scalability reasons I'd like to avoid static routes and I see many examples using BGP, but in this case it seems overkill since everything is on a single logical switch. Can I use OSPF instead? Or a different method? The Supervisors will be 2Ts, so IOS 15.0 will likely be running.
Is there a way to set static routes per VLAN?Example VLAN 100 sends all traffic to 192.168.1.1 and VLAN 200 sends all traffic to 10.1.1.1. (2800 Series RTR)I have 5 networks that have their own gateway to the Internet via satellite link. Those networks run over the same infrastructure on separate VLANs. They frequently send traffic to each other, which gets sent over a slow SAT link. I introduced a router to the network and would like to set all my hosts default gateway to the local routers sub-interface then have a static route that send all traffic that is not on one of my 5 networks back to that VLANs respective SAT modem to get routed out over the Internet.
How filter inbound routes in Cisco ASA OSPF? Because Cisco ASA has no "distibute-list" command for OSFP process configuration, I try to use "filter-list" command in area definition. So, I try to use next configuration:
we have a 2800 series router functioning as our internet router and it will only forward packets to addresses with host entries in the routing table even if the network is directly connected.
On a 4507 v12.2(20)EW, the connected subnets which are declared in the ospf instance are not propagated to the MPLS carrier router.Only the static routes which are redistributed in the ospf instance are propagated to the MPLS carrier router.
I have a Routing issue with one of my SG300-28P units. It has several Trunked VLANs. I think I habe Narrowed it down to a Default Route on the offending SG300 though I cannot see to change or delete any of the Static Routes on the unit. I can Add Routes with no issues, but once Added I cannot Edit or delete them.
I'm a bit perplexed atm with trying to set up multiple failover routes on a 2821 router. Let me say that I have more experieince in a switched network as routing is seldom required where I work atm. Here's my problem. I have a routing table set up as follows but only the primary routes work. The failover routes will not kick in once the primary route is not there.
ip route 10.32.11.0 255.255.255.0 128.32.8.11 ip route 10.32.11.0 255.255.255.0 128.32.24.11 100 ip route 10.32.12.0 255.255.255.0 128.32.8.12 ip route 10.32.12.0 255.255.255.0 128.32.24.12 100 ip route 10.32.14.0 255.255.255.0 128.32.8.14 ip route 10.32.14.0 255.255.255.0 128.32.24.14 100
Ip addresses are not exact but it gets the point across.
Why the failover routes are not failing over? The failover routes work if I remove the primary route from the config.
I am observing some strange behaviour related to the routing table, almost all external routes and some inter-area routes are getting refreshed every 10 seconds.
I am getting more than 1000 entries after running 'sh ip route | i 00:00:0', these external routes are being advertised by a neighbor 6500 which redistributing these static routes.
Is it possible to issue eigrp leaking routes on catalyst 6500 running IOS 12.2-33SXI9 on gigabitethernet interfaces? or is there another way to acomplish this?
I have a 3560 with IP base that is acting as a true EIGRP stub router today. It advertises local routes to the upstream service provider router and receives a default route.
Now I want to connect a 3900 ISR as a voice gateway. The 3560 does not seem to be advertising any routes to the 3900. Ok the EIGRP stub doc says this:
Only specified routes are propagated from the remote (stub) router. The router responds to queries for summaries, connected routes, redistributed static routes, external routes, and internal routes with the message "inaccessible." A router that is configured as a stub will send a special peer information packet to all neighboring routers to report its status as a stub router.
# Any neighbor that receives a packet informing it of the stub status will not query the stub router for any routes, and a router that has a stub peer will not query that peer. The stub router will depend on the distribution router to send the proper updates to all peers.
I guess I don't understand why the stub advertises local routes to the upstream ISP router but does not seem to advertise routes to the 3900. Does the stub identify the ISP router as the distribution router somehow, thus differentiating it from the 3900? If so, how is this done?
show ip eigrp neighbor detail on the 3900:
EIGRP-IPv4 Neighbors for AS(100) H Address Interface Hold Uptime SRTT RTO Q Seq (sec) (ms) Cnt Num
I have a WS-C3750G-24T-S layer 3 switch and I need to configure independent routes for a specific network, I'm trying to use VRF but it is not working for me. I tried using route-map but it seems the switch doesn't support that, so I'm stuck with VRF, but I think I'm not doing it right. The topology is as follows:
I have a network directly connected to a vlan and I need to forward all the traffic I get on this VLAN using a tunnel to a router. I think the problem is that in order to use the tunnel I need to utilize another VLAN which isn't part of that VRF. I attach the configuration I'm using to better understand what I'm trying to do:
layer-3 switch:
ip vrf TEST rd 1:1 interface Tunnel1 ip vrf forwarding TEST ip address 172.17.0.1 255.255.255.252 tunnel source 10.245.0.9 tunnel destination 10.250.4.31
[Code]....
And this is how my routing table looks on this router:
172.17.0.0/30 is subnetted, 1 subnets C 172.17.0.0 is directly connected, Tunnel4 C 10.250.4.0/24 is directly connected, Vlan404 S 10.245.0.8/29 [1/0] via 10.250.4.1 S* 0.0.0.0/0 [1/0] via 10.1.60.15
We have a 6509 series of core switches and 3750 series of L2 switches, There is no default gateway or any static routes to any IP.VLAN 1 is made admin down and another vlan is used for all communication here in this environment
Attached is configuration for reference But still I am able to take telnet or SSH. I want to know how telnet or SSH or tacacs authentication happens without any static or default route.
If a router receives EIGRP (AD90) routes, and is configured to redistribute thoes routes into BGP(AD20), why does the RIB show only the incoming EIGRP routes and not the redistributed bgp routes? Are redistributed routes considered for RIB entry in the router that is doing the redistribution
I was trying to find if it's possible to add the option for static routes for DHCP clients on Cisco IOS DHCP config mode. I'm looking to add a settings as defined on RFC 3442, like this one, set on ISC DHCPd server:
Global settings:
option rfc3442-classless-static-routes code 121 = array of integer 8; option ms-classless-static-routes code 249 = array of integer 8;
Is there any way to have my Cisco 877W Router alter from using one static route to another static route when another router on the network is reporting destination host unreachable?
Router 1 (192.168.2.253) Dialer0 -> ppoe to internet Vlan1 -> local 192.168.2.0/24 Router 2 (192.168.2.254) Dialer0 -> ppoe to managed VPN (172.16.28.1) Vlan1 -> local 192.168.2.0/24
Router 2 is connected to another network through a managed VPN and that network also has internet access. I want to be able to have two routes to the internet on Router 2. And when Router 1 internet goes down packets get routed through the VPN instead.
I currently have on Router 2
ip route 0.0.0.0 0.0.0.0 192.168.2.253 ip route 10.0.0.0 255.255.255.0 Dialer0 ip route 0.0.0.0 0.0.0.0 172.16.28.5 250
Which does nothing when Router 1 has its Dialer0 interface shutdown, or goes offline completely.I suspect I could reverse the setup and have everything routed through the VPN by default and then if / when Dialer0 interface goes down it would switch to using Router 2, but if the problem is in the remote network and interface Dialer0 stays up, it would probably do the same thing... nothing.All devices mentioned are Cisco 877W routers with ADSL and a bunch of fast ethernet interfaces.
I am facing an isssues with 7609 for LAN switching , based on LAN (VRRP/HSRP) feature.Actually we are having ES+ cards (on 7609) and we are using multiple groups(say 350 vrrp groups) running on the router . the routers are connected as router 1>>> mux(which is working as switches)>>> router2
my questing are
1. does their will be "multicast packets" (for VRRP/HSRP group) "from backup router to Master router", when in stable state( ie when Master and backup are already chosen) , or the packet from backup to master should be unicast.I know for sure, the packet from master to back is multicast packets denstination to Multicast IP packet and To MAC address.I am not sure but I think from backup to master it should be multicast
2. what is frequency of these packets( from backup to master)
3. As i have multiper group on a single interface ( we are using q-in-q), when the connectivity from router's is broken, then does all the groups will muticast their active roll in the lan sengment "at once" or it will be in a groups say 100 groups at once, and after few ms few 100's and sone ( as is on OSPF or RIP)
we are in between troubleshooting I hope we get the ans( Actul problem we are seeing in the router's that we have 2 ports on active routers and 2 ports on standby router , but we are not seeing muticast on 1 port on standby router where as all other 3 ports are seeing multicast packets) [code]
I have a simple design with 3750. I configured a route-map which define a next hop. I defined this route-map on a policy on a vlan interface.When I test some ping and a debug ip policy and it seems that my policy never match.Is there any mechanism that prevent the switch from using PBR? I think of CEF .
In our datacenter we have a 3750 stack with IP base image. I have enabled PBR and reloaded the switch. Show sdm prefer says i am using default template. The reason i want to use PBR is that we have 2 firewalls on the same work and want to be able to have granular control over which gateway out of the network they use but still be able to access all internal resouces accross wan and locally.
Created access list to identify traffic:
access-list 10 permit 10.2.3.59 (test workstation on vlan 3)
Created policy:
route-map TestASA permit 10 match ip address 10 set ip next-hop 10.2.0.3
Assigned policy to the user vlan3:
ip policy route-map TestASA
Results:It changed the default gateway to the above gateway but i could not access any resources on any other vlan, could not access resouces accross wan.
I have tried to make policy based routing on Cisco 3560. I use ipservices ios (SW version 12.2.(50)SE3 and SW-IMAGE C3560-IPSERVICESK9-M) For below configuration there is no problem and pbr is working.
“Access-list 100 permit ip host 1.1.1.1 host 2.2.2.2 Access-list 101 permit ip host 1.1.1.1 host 3.3.3.3 Route-map pbr1 permit 10 Match ip address 100 Set ip next-hop verify-availability 1.1.1.2 1 track 11 interface fasthethernet 0/1 ip policy route-map pbr1”
But when i add another sequence to the "pbr1" with another sequence number like that.
“Route-map pbr1 permit 11 Match ip address 101 Set ip next-hop verify-availability 1.1.1.3 1 track 12”
pbr is not working. Switch gives message "PLATFORM_PBR-3-UNSUPPORTTED_RMP:Route-map pbr1 not supported for Policy Based Routing”"ip policy route-map pbr1" command not shown in the running config. And "show ip policy" output is blank.Configuration guide says you have insert many sequence to the route-map with the same name. And also this command is not in the unsupported command list.
I have a simple design with 3750.I configured a route-map which define a next hop.I defined this route-map on a policy on a vlan interface.When I test some ping and a debug ip policy and it seems that my policy never match.Is there any mechanism that prevent the switch from using PBR?
I have problem while implementing policy based routing with a firewall. Let me explain in detail.
I have 2 remote site(Site A-small , Site B - Big) , Site B is connected with HQ with Tunnels 1 and 2 , Site B and Site A is connected with Tunnel 9941.
What I want is: Scenirio for Communication :
1)Site A--------->VPN Router Site B-----------> FW-------------->VPN Router Site B------------------>Central Site 2)Central Site--------->VPN Router Site B-----------> FW---------->VPN Router Site B-------------->Site A 3)Site B--------->FW-------------------->VPN Router Site B------>Central Site 4)Central Site--------->VPN Router Site B-------------------->FW------>Site B 5)Site A--------->VPN Router Site B-----------> Site B(no firewall) 6)Site B--------->VPN Router Site B-----------> Site A(no firewall)
I've one Cisco 3750G-12S with ip routing enable, the swtich is with IP Service firmware, with PRR support.Currently set my default static route 0.0.0.0 0.0.0.0 10.1.18.71 to my Firewall A Currently all of the VLAN for will be routed to 10.1.18.71
I've created a new VLAN 2 for my 10.1.2.0/24 network with the VLAN interface 2 ip address 10.1.2.10, my intention is to route 10.1.2.0/24 traffic to my 10.1.2.1 by creating the access list and route-map.
I've configure my test pc with a static ip and my gateway pointing to 10.1.2.10 (VLAN 2 gateway) , i'm not able to route to 10.1.2.1.
I am having a problem with PBR done on a 7604-S router - It seems like it is not done in harware. I have an Iperf client and an Iperf server, and would like to test the performance of 7600 router for PBR, supervisor is RSP720-3C-G and used interface card is 7600-ES20-GE3C ESM20G.
I have read numerous discussions about PBR that is supposed to happen in hardware when you use it with matching access-list and set ip next-hop.Although, when I start the iperf, the 7600 cpu is hitting the 80-90 % boundary, and transfer bandwidth can't go over 120-130 Mbit/s.The IP Policy is applied on an interface part of vrf ONE maybe this is casing the problem... ?
The diagram and configuration follows: Configuration:
c7604#sh run boot system flash disk0:c7600rsp72043-advipservicesk9-mz.122-33.SRE2.bin ! ip vrf one [Code]...
