We have recently purchased a Cisco ISR 2921, and on its docs it is written that this product has a License for IOS IPS Signature File, but on the product Flash Memory there is no IOS IPS Sig-File. and while i try to download the signature file from Cisco, it fails.
View 1 RepliesThe router(Cisco 857) appears to be boot, and operate normally.I have tried formating the flash, re-downloading and FTP uploading the image, and also tried the latest image c850-advsecurityk9-mz.124-15.T17.bin, but this warning message persists. [code]
View 3 Replies View Relatedwe have two ASA5520-AIP40-K8 in our office and we purchase IPS service for one only, can we also update the signature of second device before purchasing additional IPS Services for second unit
View 1 Replies View RelatedI would like to ask whether SHA1 signature algorithm is available for FWSM. We use FWSM code version 3.2(22) in our production network where only MD5 signature algorithm is available. There is a need to upgrade to stronger algorithm SHA1. From my experience I know that this is possible on ASA firewalls running on 8.4. codes. Certificates generated on code 8.4. automatically use SHA1 with RSA Encryption.
Is it possible to have Signature algorithm SHA1 on FWSM? If so, in which code version?
hba-pf-a# sh crypto ca cert
Certificate
Status: Available
Certificate Serial Number: caf44050
Certificate Usage: General Purpose
Public Key Type: RSA (2048 bits)
[Code] .....
one of our customers wants to update the firmware of a 5508 wlc, but always gets the following error message:
Error Message %UPDATE-3-INV_FILE_SIGN: Error! Invalid image signature!. Image may be corrupt.
but the same image works fine on another 5508.the update was downloaded via a smartnet for the wlc, on which the update works fine. does the customer has to download another image for the second controller, or should the image work on both wlc?
I had installed the aheros AR5B97 wireless network adapter in wondows 7, but it was not properly installed and the wireless service icon is not displayed in the network profiles.when i checked it in the device manager it showed a device status that:Windows cannot verify the digital signature for the drivers required for this device. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. (Code 52)
View 1 Replies View RelatedI am working on a Drupal site which is on a virtual server (the way it's been explained to me). I've been told I need to work with it through webdev. So I can copy a file off the server and onto my local machine. I make my edits and then try to upload it to the server. I get locked out with the message: Error 0x80070021: The process cannot access the file because another process has locked a portion of the file. I have tried shutting down my code editor, opening and closing the connection, tried different methods of reaching the server (Cyberduck and through Window's map network feature) to no avail. What can I do?
View 1 Replies View RelatedI want talk BGP with ISP though 200Mb/s WAN link by using Cisco Router 2921; and in the near future WAN link will be upgraded to 1Gb/s. Does Cisco Router 2921 has enough performance to do this task?
View 5 Replies View RelatedWe have a CISCO 2921/K9 which has the securityk9 feature set (reflects Permanent under show version)
I thought that included SSL VPN, but doing a "show license all" it doesn't reflect that:
StoreIndex: 4 Feature: SSL_VPN Version: 1.0
License Type: EvalRightToUse
License State: Active, In Use
[Code].....
Using a Cisco 2921 router with an RPS 2300, I came across a table in the 2900 Hardware Installation Guide that I can hardly believe: table 5-3 seems to tell me that in order to back up ONE 2921 with RPS power, I will need an RPS with TWO 750 Watt or TWO 1150 Watt power supplies. Is it really true that I need to throw at least 1500 Watts of backup power at a router that has a main power supply of approx 300 W?
View 13 Replies View RelatedI need a router to connect to our ISP by BGP and in a future to a second ISP. Our ISP is going to provide us about 300.000 route entries by BGP. So router 2921 would be enough??? or should i go to a higher model?We are going to have 100Mbps with this ISP and probably in 3 months we'll have to double it. Also we'll need IPv6 support.I saw router performance [URL]f and it's has 480.000 PPS and 245 Mbps but for 64 bytes lenght packages. If the packets are bigger the throughput should be best I suppose... 1500 bytes about 5,5 Gbps. In the case you consider the model is sufficient, the flash or RAM should be increased?
View 4 Replies View Relatedi have one interesting problem with local PBR on 2921 router. Here is the case,On HQ site there is 2921 router with two directly connected ISP, and there is Branch which is connected to only one ISP. The configuration should be to connect HQ router to Branch router with two VTI tunnels, so that each tunnel on HQ site should be terminated on different ISP, and EIGRP will be monitoring each VTI status.The problem is on HQ site, there is only one way to specify router with LOCAL PBR configuration, so router should send on ISP1 terminated tunnel traffic to ISP1, and on ISP2 interface terminated tunnel traffic to ISP2.
As I know this configuratino should work, but I could't make it work on c2900-universalk9-mz.SPA.151-4.M4.bin IOS, and on c2900-universalk9-mz.SPA.152-2.T1.bin.
Here is simple config:
ISP1 ip is 1.1.1.1
ISP2 ip is 2.2.2.2
3.3.3.3 is Branch ip address.
!
ip vrf BRANCH
[code]....
when I configure one default static route, it starts workig, but both tunnels go with specified ISP, and also there is no vrf problem,when there is no any vrf config it also don't work. gre tunnels also dont work.
why Cisco 2921 Gigaethernet 0/1 is not coming up ? I also tried to connect the interface to another SWITCH with no joy.
ME3400 (ISP's switch)<-------------MPLS link--------------> Cisco 2921 Gi0/1 >>>>>>>>>>Port not coming up
I tried connection between ME3400 (ISP's switch) and spare switch and the INTERFACE of spare switch was in UP/UP state .Troubleshooting I did so far on Interface Gi0/1
1> Changed ths speed/duplex manually and revert it back to auto
2>diable keepalive
3> Tried differnet LAN cable with no luck
4> Please see HIGHLIGHTED part (in red colour) of "Show controller Gi0/1" command
I am pasting some of the SHOW command output R2921_MMP#sh run int gi0/1Building configuration.[code]
I have a 2921 on Ethernet MPLS circuit. Problem is Voice has jitter at 60ms and no dropped packets from source to destination. How to reduce the jitter? Is the polices correct using Cisco recommended Nb = CAR x (1/8) x 1.5?
The PE is honoring the DSCP marked packets.
CE router 2921 QOS:
policy-map IFCQOS
class EF
priority 2048
[code]........
I am trying to set up a new router for training.I am attempting to my First BGP multihome.
The router is a 2921.We have a bonded t1 line and a metro ethernet connection
we have 2 /24 networks 1 /23 and 1 ipv6 /48 ,Behind the cisco router we have 3 Open BSD firewall Pairs, that are used to segment the networks into the production, development and my lab.
one of the /24 and the ipv6 block are veriably subneted, these are the routes that I am having troubles with.I am attempting to aggregrate the /24 and the ipv6 block to go out to the internet.
they show up in the routing table as advertised but you can not reach any hosts through the cisco router.
here is the bgp config
address-family ipv4
network 24.104.xxx.240 mask 255.255.255.240
network 204.17.xxx.0 mask 255.255.254.0
network 204.138.xxx.0
[Code]....
i need any one exact IOS from below list .can some provide me the link.
15.1(0.20)T
15.0(1)M1.4
15.1(24.6.26)PIL13
15.1(0.2.12)PIB13
15.1(1)XB1
15.1(0.0.10)PIL14
15.1(1.7.1)PIA13
15.1(1.7.1)PIA14
15.1(0.0.3)PIL15
I have a cisco 2921. I have 2 networks that has its own router
192.168.1.0 network is connected to watchguard firewall 192.168.9.0 network is connected to the cisco 2921 router.
I want to connect the 2 subnet using one of the interface of the cisco router. How I can get this work? It is not connected via vpn tunnel but we want to have LAN speed when accessing resources on both network. Each network is connected to a dell switch.
Is there a recommended number of GRE tunnels that Cisco 2921 ISR router with default configuration (512MB DDR2 ECC DRAM) can support?
View 5 Replies View Relatedi have a question regarding the monitor session command. I have following interfaces on my router:i want to monitor the traffic from the source interface Gi0/2 to the destination interface fa1/3,monitor session 1 source interface gigabitEthernet 0/2 brings this error message % Incomplete command.,monitor session 1 source interface gigabitEthernet 0/2?/ : <0-2>,i don't have any ports on the Gigabit Interfaces. Any ideas how to monitor traffic?
View 1 Replies View RelatedI have a lab setup and I want to test a point-to-point connection between two 2921 routers in a lab environment, without going through an ISP. I have a HWIC-1DSU-T1= in each of the routers. I have already configured ip addresses to the router interfaces, eDo I need to set any CLOCK RATE or BANDWIDTH commands or anything like that, since my traffic will not actually be going through an ISP during this lab test?
View 5 Replies View RelatedI have a 2921 router, with UCK9 services on it. I've installed a VWIC2-2MFT but the system is not seeing it. I've been told there is a command required to enable the card, is this true? I've always done most of my UC work on the 2800 range and never had to run an enable command, it just saw the card.
View 5 Replies View RelatedI have recently upgraded my company's network significantly, and in the process removed our Cisco edge routers and firewalls (gasp!), and replaced them with another vendor who gave a better price point for the router.However, i was only able to get ONE edge router, whereas before I had two, so I want to recycle one of my old 2921's as a cold standby (in case the brown sticky stuff hits the rotating air distribution blades, and $other-vendor router dies).Trouble is, the 2921 does not, I believe, have sufficient system resources to take the full routing table we're getting from our two ISP's.What I would like to ask is people's thoughts on the best method for me to configure the BGP setup on the 2921 to do the following:
-Accept the default route from each ISP and discard *everything* else in the route table
-Modify our advertisement (ad prepend) out the "secondary" ISP to reduce the priority of traffic coming in over this link.
-Configure the OUTBOUND priorities so that the "primary" link is used by preference for outgoing traffic (which will effectively shut down the secondary link for outbound traffic
from todays morning my 2921 is restarting about one time per two hours:
uptime is 1 minute
System returned to ROM by bus error at PC 0x23A49808, address 0x0 at 15:45:07 CET Tue Apr 10 2012
[Code].....
We recently purchased a Cisco 2921 router to be our edge device for a small satellite office (24 users). In addition, to the router we purchased a vwic3-2mft-t1/e1 module. Now the surprise, we ordered a bonded T1, I thought we were getting frame-relay circuits from Verizon, but someone ordered a 3M IMA circuit. I am new to configuring serial connections, and had planned out a frame-relay configuration. With that said, I have the following questions:
1. Can I setup a working serial connection to Verizon using the installed ATM circuit and the 2921 and vwic3-2mft-t1/e1 card I have? If not, what do I need in conjunction with the 2921?
2. With the frame-relay configuration, I enable controllers, configured the MFR interface and sub-interface, and serials. How much different is setting up serial ATM connections?
I have a 2921 series router w 15.1M series IOS. The platform has HWIC-2SHDSL module installed, which is used for point-to-point G.SHDSL connectivity. When I apply a service-policy on atm pvc, after 10 to 20 minutes I lose IP connectivity on ATM interface and tunnel interface also goes to down state. If I remove the service policy on ATM PVC IP connectivty returns back.
Interestingly I use exactly the same config on 2821 platform (w. WIC-1SHDSL installed) and I do not live such an issue on that platform.I tried to carry the Qos config on to Tunnel interface with shaping enabled and "no qos-preclassify" command issued, but the result is the same.
policy-map MetroDSL-llq
class sna-dsl
bandwidth percent 10
class netbios-dsl
bandwidth percent 10
[code]....
We have multiple sites that have either fiber 20mb d/u or cable 50/10 d/u. Recently we have upgraded our head end router to a 2921 security based router and noticed that no matter if we are sending or receiving the most we can push is 1.6Mb. I would expect this number to be at least 8Mb for uploading and at least 18mb for downloading from other sites.I have included parts of my config and screen shots of bandwidth usage for troubleshooting. [code]
View 3 Replies View Relatedhow to enable the SFP module on cisco 2921?
View 3 Replies View RelatedI have an office with 50 users. I have both a 2851 and a 2921 available. Which one would be a better fit?
Comparativley, which is the more powerful unit?
I have been using "debug ip packet" on a Cisco 2921 running IOS 15.1(4)M1. The problem I have is that, although I am using an ACL to limit the output, I am seeing some output that is distracting from what I am trying to see. Specifically, I am seeing the following:
Mar 19 20:22:36.135: IP: s=192.168.20.253, d=224.0.0.2, pak 30DB6D4C consumed in input feature , packet consumed, MCI Check(80), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
[ code]...
These would appear to be HSRP messages. But I don't understand why they are appearing when I configure "debug ip packet 101". The ACL is pretty simple:
access-list 101 permit icmp host 96.87.145.1 host 192.168.20.1
access-list 101 permit icmp host 192.168.20.1 host 96.87.145.1
So I thought the implicit "deny ip any any" would block these messages. I even tried to block them specifically using an extra line:
access-list 101 deny udp host 192.168.20.253 host 224.0.0.2 eq 1985
But still they show up!
I actually starting to work on a cisco project. I'm a beginner on networking and cisco technologie.
For my project we use a router 2921.
We got two network:
- Network A: 192.198.0.X / 255.255.255.0 / Gateway 192.198.0.1
- Network B: 162.168.0.X / 255.255.0.0 / Gateway 162.168.0.1
Each network use switch, Switch A (connecting to network A) is connected to interface G0/0. And Switch B (connecting to network B) is connected to interface G0/1.
Router well configured as:
- G0/0: ip address 192.198.0.1 255.255.255.0 (network A)
- G0/1: ip address 162.168.0.1 255.255.0.0 (network B)
Every think working fine.
The problem is with this one, we need to connect a computer on G0/2. This computer is configure as network A (192.198.0.10 / 255.255.255.0 and same gateway).I can't configure G0/2 as 192.198.0.1 255.255.255.0 (network A), cause G0/0 use this adresse.I can't put this computer on the switch A, my only physical possibilité is to connect him on G0/2.We just need to use interface G0/0 and G0/2 as a switch on the router with the same gateway (192.198.0.1)
How can i connect this computeur? How can i configure two interfaces on the same network and same gateway?
We have a Cisco 7204 G1 running c7200-advipservicesk9-mz.122-33.SRE7.bin and we're having a lot of difficulties getting a VTI working to a Cisco 2921 with adv. security. I've ruled out that the 2921 is at fault by successfully establishing a VTI to another 2921 and a 7200 running a different IOS release.
We see the tunnel come up, but when I sent a ping from the 2921 to the 7204 there isn't a reply. When I look at the results on the 7204 from a 'sh crypto engine connection active', I see the decrypt counters increase, but I don't see the Encrypt counters increase as it's trying to reply to the ping. I'm not sure if this is because there is an issue with the encryption or whether there might be a more fundamental issue with the router not replying to the pings.
I've tried the following IOS releases (c7200-advipservicesk9-mz.122-33.SRE7 & c7200-advipservicesk9-mz.122-33.SRE6) and they all behave the same way - this makes me think it might be a config issue rather than and IOS bug which is what I first thought. c7200-advipservicesk9-mz.122-33.SRE7.bin.
sh crypto engine connections active
Crypto Engine Connections
ID Interface Type Algorithm Encrypt Decrypt IP Address
1 Tu10 IPsec 3DES+SHA 0 31 10.5.5.1
2 Tu10 IPsec 3DES+SHA 19 0 10.5.5.1
1001 Tu10 IKE SHA+3DES 0 0 10.5.5.1
Here is a copy of my config on the 7204 - the other end (Cisco 2921) is configured in the same way.
crypto isakmp policy 1
encr 3des
authentication pre-share
[code].....
We are deploying softphones for remote employees in our company. We currently are using Cisco 2921's with VPN enabled.
All of the clients who connect with the Cisco VPN x86 client are getting 00:00:00:00:00:00 for their MAC Addresses, and all of the Cisco VPN x64 bit clients are all getting the same MAC Address, although it is different than the x86 clients.
This is causing the softphones to not work, as they all need to be sending independant MAC addresses.
I have two routers 2921 and 2821. Also 2 WAN Links from two Different ISP's. Presently I am using Static Routing with PBR for traffic shaping.
Now I want to use BGP Routing in my network. What is the requirement for using BGP. Does ASN need to buy or the ISP will provide ?