how to configure the ASA 5500 with "Directed Broadcast" for Wake of lan from other networksegment. we want pass traffic from 192.168.10.0 network to 192.168.100.0 DMZ Network to turn on the server with Wake on Lan.
I read something about "Static NAT" but how do i make this one?
I am trying to setup the WOL for our enterprise. We have a C4500 setup with mutliple Vlans. We are using Microsoft SCCM server to wake up workstations for security update. The workstations are on vlan190 and the Microsoft server is on vlan 441
Here's my config
the config below
interface Vlan190ip directed-broadcast 100 (Enables the translation of a directed broadcast to physical broadcasts)
access-list 100 remark ====== Wake-On-LAN ======no access-list 100 permit udp host 10.4.40.98 any eq 9 logaccess-list 100 remark ====== End of ACL 100 ======
[Code].....
I've read the document (Document ID: 91672) on setting up WoL, but I had a few questions as this doesn't completely fit our situation.We have 4 3560 switches, 3 have only access to vlan 1, SW4 has access to vlan 1 and vlan 2, every switch is connected by fiber to a 3750.We want to enable every server/PC on vlan 2 to allow WoL packets to all PC's on the internal network (so WoL through all 5 switches). In the above document, it allows WoL to be executed only from a single IP/Server, is it possible to allow an entire vlan to execute WoL? or allow multiple IP's to execute WoL? Also, in the switch configuration it says to type
-"switchport mode access"
-"switchport access vlan4"
-"spanning-tree portfast"
We do not use STP and is disabled, is portfast required for WoL use? if Port Fast is disabled by default, could this also be blocking a WoL packet from vlan2 to vlan1 on the same switch?
Since a upgrade in IOS XE 3.0.9, our ASR 1002 have a problem with the DHCPDISCOVER.
View 1 Replies View RelatedI have 2821 router configured with two subinterfaces. This router is connected on cisco 2960 switch. The trunk on 2960 is configured without any prunning of vlans. I noticed that udp broadcast traffic is being forwarded through my router on native vlan 1 (this interaface do not have ip address configured). Below is configuration:
Router:
interface GigabitEthernet0/0
no ip address
duplex auto
[Code]....
I'm working with some 891W's that have the internal 800-series AP. I have this router set up initially using Cisco Config Express, then, using Cisco Config Professional 2.5 I set up the firewall and other featuress that CCE doesn't do. Overall this is a very simple router, meant to be a small business Internet gateway device but is currently in my lab.
The intended WLAN setup is very simple. One SSID, with broadcast enabled, using WPA2-Personal. Auth: open Encryption is both TKIP and AES-CCM.
However no matter what I do I cannot get thhis thing to broadcast . In the past I had sometimes run into issues where if I had more than one AP running independently it would cause a channel conflict and one or both would cancel each other's radio, so I disabled all other AP's in my vicinity.
Also I've had issues in the past where f I enabled both TKIP and AES, sometimes clients can't find the AP as a result. My solution had been to disable one of them leaving just the other - no change here however.
Via the IOS, ssid config shows mbssid guest-mode which I believce is default.
Interestingly, if I do the following:
ap# Config t
ap(config)# dot11 ssid <myssid>
ap(config - ssid)#guest-mode
end
I end up with both "guest-mode" and "mbssid guest-mode" in the sh run for the AP, and voila, my AP broadcasts the SSID. However clients end up joining without any security at all, no prompts for pre-shared key or anything.
I am using 1841 LAN router. Recently some broadcast is happening in our network when some users are connected. I need to block them automatically by detecting who are they.
I can block them manually but i want router to detect them and block.
I have a 3945 with a basic DHCP configuration applied to it. This 3945 is connected into one of the access ports of my nexus switch. I'd like to simply have the 3945 hand ip addresses out to other clients connected to the nexus switch. I have zero experience with nexus & haven't been able to turn much up through searching the net.
View 1 Replies View RelatedI recently bought SG-300 28P to create the VLAN. My network hs 3 subnet 192.168.1.0, 192.168.2.0 and 192.168.3.0.My main net work is 192.168.1.0. I want to divide it to VLAN to eliminate the boardcast storm; especially from the domain 192.168.3.0
But I want all the devices from 192.168.1.0 to access other subnet.
We have 2 switches split across 2 datacentres connected via an interconnect. Over the past couple of days the interconnect provider's Cisco kit has shut down our port (err-disabled) due to a broadcast storm. They had the level set at 1 which I thought was a bit low. They say they tried to set to 2, then 5 but still kept tripping the storm-control feature so they set at 10. They say they've always had it set at 1% (on a 100Mb switch) and so we must be generating more broadcast traffic.
I'm trying to identify where the broadcast traffic is coming from. On our Cisco 3750 I've clear interface counters and when I do a sh run | i broadcasts there are a few ports which have what seems like a high broadcast count. The one port that is especially high and the only one tripping the storm-control feature (I've enabled on all our ports to try to identify where the traffic is coming from) is the port connected to the 100Mb interconnect. I've mirrored that port to another port and connected a server with wireshark so I can capture all the traffic across that port.
What I'm struggling to find is the source of the broadcast traffic.I have a few questions are these broadcasts layer 3 or layer 2 broadcasts. Also in the output below when it says broadcasts received is this inbound to the port i.e. from the connected device or is this a total of inbound and outbound broadcasts.
When I use wireshark and filter the capture on broadcasts (ff:ff:ff:ff:ff:ff) I see only 200-300 compared to the thousands the switch is reporting.If I filter on the broadcast IP address I also don't see the numbers corresponding to what I see in the show interface output.
GigabitEthernet1/0/1 is up, line protocol is up (connected)
Hardware is Gigabit Ethernet, address is 0014.a93f.7401 (bia 0014.a93f.7401)
Description: Interconnect
MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
reliability 255/255, txload 4/255, rxload 44/255
Encapsulation ARPA, loopback not set
[code].....
also I'm currently doing : monitor session 1 source int g1/0/1 both, and also tried just rx incase I just need to be looking at receive traffic but still nothing is standing out.
Is there away to disable the mulicasting of eigrp and hsrp to the end user ports on a 6509?
View 2 Replies View RelatedHow do I limit broadcast/mulitcast traffic on a switchport to e.g. 5000 pps ? I don't want the port to shut down, just block or drop broadcast traffic that exceeds 5000 pps.
View 19 Replies View RelatedI have a bunch of 3750x switches that each have a 10 gig routed link back to a central 4507 (loopback = 172.30.255.255).We carved up a /24 (of course, the /24 doesn't really exist except in our address tracking spreadsheet) into a bunch of /30's for routed WAN links and /32's for loopback addresses.We started on the low end for /30 subnets (ie 172.30.255.0/30, 172.30.255.4/30, etc.).We started at the high end for the /32 loopbacks (ie 172.30.255.255/32, 172.30.255.254/32, etc.)
Well, when I try pinging 172.30.255.255 from the access layer 3750x switches, the 3750x seems to be treating it as a broadcast ping where it lists each member that responds instead of the regular !!!!! response (this makes think something is odd with the 3750x). Of course, only one member responds (the core). But even the core seems to respond with the other end of the /30 instead of the actual /32 loopback (which makes me think something is odd in the core). I could have sworn that I've setup similar topologies without problems (ie, using 10.0.0.0/32, 10.255.255.255/32, etc as loopbacks) and as long as the mask is a /32, it should work.Also, I can ping/ssh to that loopback if my laptop is on a directly connected subnet. But I can't do it from any of the 3750x switches (which are also directly connected).I've double checked for overlapping subnets, but nope. I don't see any. Routing looks fine. The actual /32 is being propagated everywhere properly.
We run a network of several 2960G and 3650G switches in a network with a number of VLANs. One one particular VLAN (let's call it VLAN 10) it appears that non-broadcast traffic (i.e. normal unicast traffic) is being copied to every port in VLAN 10 only on one switch . The traffic is not crossing trunk ports and does not appear on other switches that have ports in VLAN 10. We first spotted this by noticing that a UPS port had an unusual amount of activity on our port througput graphs:
This traffic at 4 am is not expected and this profile is repeated across all ports in VLAN 10 on this switch (a WS-C2960S-48TD-L stack running IOS 15.0(1)SE3)\iffed one port using local SPAN (the UPS port) and discovered that this traffic was not broadcast, which was running at a normal low rate at all times. The traffic appeared to be unicast traffic from other ports of the sort you might see on a hub. It was from various hosts that live on VLAN 10, most (not all) of the conversations had one end station homed on the 'problem' switch. There are about 800 non-broadcast packets per hour and this is a busy VLAN so it does not account for all the traffic on the VLAN.
I have recently configured secondary ip address on LAN Interface of Cisco C6509.. We have some application which needs to use broadcast traffic communication to communicate with client... Broadcast is working within subnet & also working from broadcast server to primary subnet. But not working from secondary subnet.. I have checked broadcast within secondary IP range & it's working fine... Secondary not working broadcast with primary and also with broadcast server... broadcast address is different for these subnet but both should be communicate since configured on same interface... When I went through Cisco website found that command "ip directed broadcast" which will pass broadcast to different subnet... But I'm not sure whether any other impact if I enable that command on particular Ethernet interface...
View 6 Replies View RelatedOur network feels slow and trying to find the best way to investigate this properly. We have Cisco chassis 4500 with mix of 3560/2950 Edge switches 1GB backbones and WLC/WCS in place. The network is broken into multiple V LANS and IOS on our switches haven't been updated in 3-4 years.
On a wireless laptop (G) with get throughput of 1-2MB/s transfer speed with usually 10 clients per AP and LAN we get anywhere between 7-15 MB/s transfer. Using wire shark on a wireless laptop we see a lot broadcast traffic from other clients and the same for LAN. What is the best way to troubleshoot performance issues on the network and where do I start?
Trying to configure my desktop to Wake on Lan. I have the BIOS set to WOL(PME) enabled, i have the ports set up, and everything. I installed a WoL Sniffer on the desktop, and sent a wake up command and the sniffer showed it came through (with the correct FF FF FF FF FF FF <Mac address repeating>). The router it's hooked up to has the UDP port 9 forwarding, ad that's what my WoL tool is sending, and i see the light by the ethernet port and it does indeed flash repeatedly when i try to send the WoL magic packet.However, nothing happens. It's shut down, plugged in, i used the soft shut down from windows,If it was the router, then the light wouldn't flash when sending it...
View 2 Replies View RelatedI have two cisco asa firewalls connected through a VPN, one is 5505 and the other is a 5510. From the 5505 I can ping the internal interface of the 5510, but not vice versa. Would that be a NAT issue? I used the ASDM to configure the VPN tunnels with the wizard for IPsec site to site.
View 3 Replies View RelatedOn one of our laptops we are using MSN.com as our Homepage. Today when we try to open MSN.com we are directed to a screen wanting us to open a Microsoft account What do you think we can do to eliminate this problem.
View 1 Replies View RelatedHow to you setup ip routing on a Nexus 5500 I want to do vlan routing between an Nexus 5500 and Catalyst 3750. Nothing clever just have the 2 switches talk and vlans route between the two.
View 3 Replies View RelatedHow many VMs can a pair of 5548s support? Remember, for each VM, I will have an ARP entry in the 5500 ARP Table (assume 5500 is the L3 default gateway).
View 3 Replies View Related: %DATACORRUPTION-1-DATAINCONSISTENCY: unterminated string in buffer of length 129, counted: 129 -Traceback= 4027CB2C 402B1E88 4052884C 40528A48 40528D08 40529188 40529358 403247E8 403247D4
Cisco Internetwork Operating System Software
IOS (tm) C5RSM Software (C5RSM-ISV-M), Version 12.2(46), RELEASE SOFTWARE (fc1)
Copyright (c) 1986-2007 by cisco Systems, Inc.
Compiled Thu 26-Apr-07 19:41 by pwade
Image text-base: 0x40010948, data-base: 0x410F41D0
[code]....
Is there an official Cisco-Page with the always-up-to-date recommended NX-OS-Releases for the Nexus 5000, just as there is URL
If there is no such page: What Release can be recommended?
We got new N596 & N2232 this week, and are using L2-LAN only, no L3,no FCoE- or FC-Ports. The command 'vPC orphan-ports suspend' is the newest feature used, so 5.0(3)N2(1) would be the oldest possible release.
Before I install 5.1(3)N1(1a) and then have to do a distruptive downgrade to 5.0(3)N2(2b), I'd like to be assured that the new one is already recommended as mature enough.
Having an issue with my WLC 5500 and client connectivity. This just started today. Clients will connect for a short period of time and then drop off. WLC appears fine with the exception of a bunch of trap errors. I've rebooted the WLC but this did not clear the issue.
View 3 Replies View RelatedIOS we used for limiting access for a group we used configuration of snmp-server views like following
snmp-server group backupgroup v3 priv read backupview write backupview access 20 snmp-server view backupview ccCopyTable included could not find out how to achive this config in NX-OS on Nexus5500
Are there any dependencies on VTP on the Nexus platforms like the 5500 or 7000? In IOS P V LAN required VTP Transparent mode however I cannot find any reference to this for the Nexus platform. Are there any other features that would require the use of VTP? By default VTP is turned off on nexus and has to be enabled with the feature command so is there any benefit to running VTP in transparent mode vs off?
View 1 Replies View RelatedThere is very little and quite diverse Information regarding the if, where and how of a Nexus 5000 or 5500 series Switch and support for IEEE 802.1AE Link Layer Encryption (also called MACsec).
For example: the official FAQ denies that the Nexus 5500-series supports 802.1AE at all, while the data sheet says that only "downlink ports" are supported (host access).
On the Nexus 7000 platform the 802.1AE link layer encryption is part of TrustSec (feature cts) and much better documented.
The Question is: If and under which circumstances (configuration, L3 modules, license, NX/OS version) does a Nexus 5k or 5500 series Switch support 802.1AE on 1G or 10G interfaces that are directly connected to a Nexus 7000 (with the necessary cts feature licensed/configured)?
We have successfully peered two 5548UP switches together and separately we have successfully peered two 5596UP switches together. Works great and is our standard going forward for data center switching. I've been casting about Google and Cisco looking for an answer to this question:
Is it possible to have more than two 5500 class Nexus switches participate in a peered vPC configuration? For instance, can I connect a single FEX to four 5500 class switches in a vPC configuration? The question is more academic than actionable. Even if the answer is yes we probably wouldn't be in a position to implement something like this for a while.
Does the Nexus 5548/5596 switch support OSPF ECMP?
Also on OSPF and ECMP, the load-balancing method at the multiple links for Catalyst 3750 is per IP packet or per destination IP?
I am experiencing inconsistent echo-replay from devices connected via VPC to Nexus 5500s while pinging from the Nexus exec prompt.
In some cases I receive normal response when pinging from one Nexus, but no response when pinging from the other switch. In other instance I receive normal response to one Nexus, and duplicate replays to the other. It looks like a VPC related bug. NXOS is 5.1.3.N2.1
5501# ping 10.12.12.232
PING 10.12.12.232 (10.12.12.232): 56 data bytes
64 bytes from 10.12.12.232: icmp_seq=0 ttl=253 time=8.585 ms
64 bytes from 10.12.12.232: icmp_seq=0 ttl=254 time=9.227 ms (DUP!)
64 bytes from 10.12.12.232: icmp_seq=1 ttl=253 time=1.011 ms
64 bytes from 10.12.12.232: icmp_seq=2 ttl=253 time=8.097 ms
64 bytes from 10.12.12.232: icmp_seq=2 ttl=254 time=9.429 ms (DUP!)
64 bytes from 10.12.12.232: icmp_seq=3 ttl=253 time=18.195 ms
64 bytes from 10.12.12.232: icmp_seq=4 ttl=253 time=8.807 ms(code)
We are working with a contractor to upgrade our network, and I heard from them that the 5596/5548 might not need the Layer 3 module for our inter-VLAN routhing. They have yet to give me an answer.
We do have a few static routes on our current layer-3, core switch too.
Nexus 5500 support auto negotiation on 1gig sfp port? There is an end device that only support auto negotiation and cannot be manually set speed/duplex.
View 0 Replies View RelatedI have a Nexus 5500 which is the core of our network and we have access layer switches uplinked to it. I know by default the qos markings will be trusted.
1. On a trunk uplink from an access layer switch to the Nexus, I have "mls qos trust dscp". Will the DSCP marking be preserved when it reaches the Nexus?
2. How do I do prioritization of voice traffic on an uplink on Nexus based on DSCP EF?