We have an MPLS that connects our main office with our 7 branch offices. We have 3Mb coming into the main office and 1.5 into all of the branch offices. I would like to give rdp traffic the highest priority. We have a Cisco 1841 at all branches and a Cisco 2811 at the main office. Do I have to configure QOS on all routers or just the one at the main location?
View 5 Replies im attempting to setup a L2L VPN between an 1841 and an NSA 2400, via the SDM.The Tunnel comes up, and when I test connectivity it shows as being successful, but I do get an error stating:-
"A ping with data size of this VPN interface MTU size and 'Do not Fragment' bit set to the other end VPN device is failing. This may happen if there is a lesser MTU network which drops the 'Do not fragment' packets."
From my reading this shouldnt cause all traffic to drop though, right?
Currently I cannot ping or telnet to services from one end of the tunnel to the other. I was able to ping momentarily from the Sonicwall end at one point, but this disappeared shortly afterwards (without my changing anything regarding the config).
All of the ACLs created were populated through the SDM.
I am about to pull my hair out. I have a 1841 router at one end with 3 ASA's for teleworkers working great. I'm connecting a 4th one that I can not get to work for the life of me. The tunnel is comming up, but its not passing any traffic. I don't see any glaring errors in the VPN debug. The router comes up, reverse route injection does its thing... all looks great. Am I totally overlooking somthing? I must have rebuilt this a dozen times.
: ASA Version 8.2(1) !hostname ciscoasa104domain-name default.domain.invalidnames!interface Vlan1nameif insidesecurity-level 100ip address 192.168.104.1 255.255.255.0!interface Vlan2nameif outsidesecurity-level 0ip address dhcp setroute! interface Ethernet0/0switchport access vlan 2!interface Ethernet0/1!interface Ethernet0/2!interface Ethernet0/3!interface Ethernet0/4!interface Ethernet0/5!interface Ethernet0/6!interface Ethernet0/7!boot system disk0:/asa821-k8.binftp mode passivedns server-group DefaultDNSdomain-name default.domain.invalidsame-security-traffic permit inter-interfacesame-security-traffic permit intra-interfaceobject-group network DM_INLINE_NETWORK_1network-object 192.168.2.0 255.255.255.0network-object 192.168.4.0 255.255.255.0access-list outside_1_cryptomap extended permit ip 192.168.104.0 255.255.255.0
[code]....
We are currently experiencing a problem on an IP SEC VPN tunnel that has all of us here completely stumped. We are hoping that one of you experts out there will be able to assist. Here are some basic details:
NETWORKS
An IPSEC site to site tunnel has been built between the two sites on different networks.
PIX 515E - MAIN SITE
Network 172.16.0.0/24
CISCO 1841 - REMOTE SITE
Network 172.16.99.0/24
ISSUE
All traffic flows over the VPN from the 172.16.99.0 network in the direction of the Pix, such as RDP, SIP etc. Pings will go in both directions across the tunnel. Other than the pings most traffic will NOT flow over the tunnel from the 172.16.0.0 network on the pix to the 172.16.99.0 network on the 1841. It would appear that something on the 1841 is blocking traffic coming in over the tunnel from the 172.16.0.0 network as we can not get a wire shark capture on a PC on the 172.16.99.0 network, other than the ICMP traces. Usually this is an access list problem but we have checked and double checked the configuration and can't see anything.
TROUBLESHOOTING SO FAR
1. Have tried inserting various access list changes to the tunnel on the 1841 to make specific reference to the 172.16.0.0 network.
2. Have tried various NAT entries.
3. Have removed and then recreated the VPN tunnel from a fresh start.
4. Have made the MTU 1400 on the inside interfaces on the Pix and the 1841.
The tunnel is fully up at all times and as we say can ping in both directions.
I am in trouble with my cisco 1841 configuration.The "what I want to" schema: very external IP ( AAA.AAA.AAA.AAA ) in the internet cloud => | cisco 1841 external IP BBB.BBB.BBB.BBB | => internal computer IP CCC.CCC.CCC.CCC
View 1 Replies View RelatedI am in trouble with my cisco 1841 configuration. The "what I want to schema":very external IP ( AAA.AAA.AAA.AAA ) in the internet cloud => | cisco 1841 external IP BBB.BBB.BBB.BBB | => internal computer IP CCC.CCC.CCC.CCC
Steps (this what I think should be done):
1. Find all packets from A by acl
2. Route finded packets throught cisco1841 directly to internal ip address
It should be easy but it doesn't.
I run a network that uses MPLS circuits to connect all of the companies different stores. Internet access is through a Cisco ASA5500 here at the corp headquarters.
To make all of this work, we use a little 1721 gateway router to move traffic as needed. All the clients in our corporate office use 10.10.99.1 (Cisco 1721) as a gateway. The 1721 routes the traffic either to the internet (10.10.99.106 Cisco ASA5500) or the MPLS router (159.61.54.30).
For some reason, anything that runs on Linux (Ubuntu server, ReadyNAS boxes, Thecus NAS) will not pass traffic beyond the 1721 gateway router.
I've poured over the config for that router, and I can't find anything that could be causing this not to work. Thinking that the 1721 was bad, I put an 1841 online in it's place, and it did the same thing. I'm a noob when it comes to Cisco configs, but am learning as I go along.
Ive attached a txt file of the 1721 config.
i am having 2 locations & having cisco 1841 & 2821 at both the end connected via a P2P link. Now when i trace location A from location B, the traffic is getting dropped at location A's Vlan HSRP IP address.there is no ACL in that Vlan, but still it is getting dropped.
View 1 Replies View RelatedI have two 1841's, setting up a Lab WAN in Packet Tracer. I have one of the 1841's run to a DSL modem, then out to the cloud and the same setup on the other end... from the cloud to the DSL modem and to the 1841 on that end... I have all green lights, so that tells me layer 2 is up, but I'm trying to figure out
what IP to assign the routers to test pinging and getting traffic flowing. but the DSL Modem's have the public IP's and dynamically assign an IP to the routers? I've also tried setting up a static IP on the routers fa0/0 interfaces and the pings fail.. Wondering what I am missing to get these two talking.
Using the Cisco Configuration Professional software I have created a site to site VPN connection (between a cisco 1841 and 1811).The tunnel appears to be up as far as the routers are concerned, but I am unable to ping anything on the remote networks. I thought route maps may have had something to do with this but I cant see what is worng with them.Just so you know, the 1841 device already has a functioning VPN tunnel to another site. The peers I am concerned about are 141.0.59.x and 109.238.78.x.
View 12 Replies View RelatedWe have cisoc 2821 at one of branch and created five sub inetrfaces for different vlans.Output of Show interface shows very frequent increase in the input error count.I have changed the physical cable and switch port on the other side.But still error rate is increasing.When the traffic is less error rate is low but with high traffic it is increasing drastically.My router process is very less(4%) only.What could be possible reason. [code]
View 8 Replies View RelatedWe are looking to implement traffic shaping/policing primarily for P2P traffic. As natively the ASA5550 is only capable of p2p inspection if the traffic is tunneled via port 80 is the AIP-SSM the way forward? We have 2 5550s in active/active failover config. As a side note we are also looking to implement an IDS/IPS system so could this module cover all?Is this module going to provide the desired outcome or is there another module/device out there better suited for this? I would prefer to use the ASA5550s as opposed to implementing another product if only that we can make use of the investment we already made on these devices.
View 1 Replies View RelatedI am testing limit bandwith using my ASA 8.2, i am trying to limit internet access for certains users , i order to save Bandwith for the important things but i can´t get any limitation
My configuration is the following, the acces list is just for my pc in order to test, and the service policy is applied to outside interface (called internet in my case) for incoming traffic
access-list Internet_mpc_1 extended permit ip host 172.16.127.70 any class-map Internet-class-TEST match access-list Internet_mpc_1 policy-map Internet-policy-web class Internet-class-TEST police output 1024000 1500
service-policy Internet-policy-web interface Internet
With show service policy i can´t see any activity on the policy , but if i do a similar configuration for inside interface outgoing traffic i can see packets allowed and dropped
I have an ASA 5520 with the below config
Gi0/0: outside (Internet)
Gi0/1: inside (Internal users)
Gi0/2: DMZ (web servers, ftp, Mail etc..)
I have a SMTP relay deployed on the DMZ for mailing. I have also a mail servers installed in the internal lan,
I want to allow trafic from dmz to reach internal lan, and i want normally also allow stmp relay from dmz to reach Internet.
How can i block trafic from DMZ to reach Internal Lan (instead of smtp) if the to allow trafic from dmz to internet i must put ANY in the policy?
For allowing trafic from DMZ to reach Internet, the policy must be DMZ -----> ANY ----->Services., this policy means DMZ can implicity reach Internal Lan?
We have a Cisco 2811 running ITP IOS. On that router we run the SMPP service. A client on the network connects to this service, and we need to capture the traffic for debug.
I've tried traffic-export, but I cannot see any outbound traffic.I'm guessing that this is due to the fact that the outbound SMPP traffic is not transit traffic as it is generated by the router itself.
Is there any way to capture the outbound traffic?
I am trying to come up with the best way to traffic shape traffic with 3750 Me switches. the traffic will be coming from a 6504 Sup-7203b downstream and going out the wan. Core---L3---->6504--intvlan80--trunkport to--->3750Me---g/1/1/1-trunkport to---MetroE network--->int f0/0.80--branch router. The idea is to use the 3750 to traffic shape the traffic going towards the wan/branch to 500 to match the contracted rate and then to use qos on shaped rate. I tried to apply it to g1/1/1 using port based policies but it did not shape the traffic. I changed everything to IP interfaces and it worked. I need to break up the metroe into different vlans so I can bring branch offices in on different vlans.c
View 3 Replies View RelatedI am putting an pre-labbed DMVPN Hub config onto a production 1841. We had to upgrade the IOS to support protection with NAT so the current IOS we're running is c1841-adventerprisek9-mz.124-25g.bin.I can paste the configuration in fine (via the tunnel interfaces) and the router accepts it however the 'show dmvpn', 'debug dmvpn' and other related commands don't work. I have checked the IOS feature navigator and it definitely shows that DMVPN phase 1 and 2 are supported in this image.
View 5 Replies View RelatedI have a 1841 router and I can ping the f/0 port from my pc. However when i try to console to it, it is not showing up anything but a blinking cursor. I tried all different baud rates on my teraterm but still not luck. I picked the baud rate disconnected and reconnected everytime and still nothing. Then I tried to telnet to it using teraterm but it would just open a console window and then close.
View 10 Replies View Relateda have a router CISCO 1841 and I configured a NAT inside from the router to the firewall like this :ip nat inside source static firewall_adresse public_adresse and its work fine and when a added it I do this command "wr" to save the configuration and I restarted the router many times and it still work fine,but in the last five months this NAT does not exsit twice and I must add it a gain.
View 7 Replies View RelatedHow to enable GUI for a Cisco 1841?
View 4 Replies View RelatedI have a cisco 1841 router and want to run BFD i think it needs IOS 12.4T..It has currently 12.4 but no T does the "T" IOS have mroe features?
View 1 Replies View RelatedHow to enable GUI for a Cisco 1841?
View 1 Replies View RelatedWe have a 1841 setup with WAN and LAN subinterfaced(2 WAN connections, 1 internal VLANs) and I am recieving some pretty horrible throughput when traversing the router to the WAN.
I am receiving about 2 MBPS down but around 5 up.Currently there is a ACL on the WAN interface, and as well we are running NAT NVI. It is possible that this might have something to do with it, but I am not sure.
Most of the CPU is going to IP input however I cannot seem to determine the cause. One thing I am thinking is the overload for NVI is using a route-map. Could that cause it to process switch instead of fast/CEF switch?
i have 6 sites using tandberg visioconference system, each site have a cisco router 1841 configured with ipsec vpn, i have a 4 conference a week and my bandwidth is 2 meg, and when people are working we have a lot of problems and cut in our visio conference.
I have a big problem, i want to make a high level QOS priority to my TANDBERG visio conference system between my sites, the issues is that there is an IPSEC VPN in my cisco routers between those sites and as i know if the traffic is crypted we can not separate the packets or give higher priority to packets over anothers.
can i mark traffic in the lan interface and and make a high priority befors the packets go through the ipsec tunnel?
We have cisco 1841 router with two ISP . But we facing the problem whenever our secondary ISP Link goes down the Primary has also went down.We have only one default route for primary Link
View 1 Replies View RelatedOK ran into a little problem with getting this to work. Only group members participate in the encryption process, correct?
I have numerous remotes all coming into one central location. I set up a KS and have currently only 2 of the remote routers set up as GM's, with the intention of the others coming into play as I move forward. Here is basically what I have in my KS and GM's:
KS
crypto isakmp policy 10 encr aes authentication pre-share group 2crypto isakmp key testkey address [code].........
GM's
crypto isakmp policy 10 encr aes authentication pre-share group 2 lifetime [code]....
So I applied the crypto map to the serial interfaces on my routers on either side of the cloud (central-ASR1002 and remote-ISR1841). When I did this, ALL the remotes went down and I'm not sure why. Even the ones that didn't have anything to do with gdoi. Ya, it wasn't good. I thought that only the group members would be affected.
Is it the fact that my acl is encrypting any to any? Surely I don't have to reverse that and have two statements with the same syntax. I'm basically just trying to encrypt all traffic from specific remotes back to the central side. However, I'm trying to do it without taking down the rest of my network .
I have recently started a new job where the IOS on the 1841 routers is version 12.4. These are from 2006 mainly, probably when the routers were bought.should I upgrade to 15.0? Mainly just to plug security holes that cisco have found?
View 8 Replies View RelatedI'm setting up an 1841 as a basic router for now and I cant get it to work.
[code]....
EEM script. I have tried below script on 1841 with 12.4(24)T5 but not working
snmp-server enable traps ipsla
snmp-server enable traps event-manager
ip sla 10
[Code].....
I want to try ping remote ip every 5 mins , if ping fails wait for 3 mins then trigger reload , and router come up again if ping fails reload again.
Here is the setup :
site 2 site ipsec
pix 515 as the server (static ip)
Cisco 1841 (dhcp client)
ezvpn client works fine for normal users that want to just authenticate with the Cisco vpn client. i have a site 2 site setup from the pix to my house, the connection is "up" on both ends, i see phase2 initiate under the pix logs . try to ping nothing happens, even drop down the byte size and the DF bit (aka ping xxx.xxx.xxx.xxx -l 100 -f ) ping to the next routed interface hop and i get "no translation group found for icmp src outside: xxx.xxx.xxx.xxx <--- my internal network dst inside xxx.xxx.xxx.xxx <---- pix internal network .
Am i missing a NAT rule on the pix or the 1841?
i've been trying to setup an SSL VPN on my 1841 lab router but with no luck. i tried both clientless (anyconnect 2.5) and using a vpn client (anyconnect 3.0).
i'm using a win 7 PC with IP 172.16.1.50 directly connected to 1841 FE0/1 port. tried disabling PC FW, used both IE and FF and delete cookes but to no avail. below are my config and some show and debug output.
SSL_VPN_GW#show webvpn gateway
Gateway Name Admin Operation
------------ ----- ---------
SSL_VPN_GW up up
SSL_VPN_GW#show webvpn context(code)
Here is my current situation, I have 3 Internet connections as below, at the moment they are terminate into the ASA.
ADSL Modem 1 (routed mode) ADSL Modem 2 (routed mode) Mid band Ethernet Tail (10m/10m)
ASA 5510 LAN Switch
I want to change it to the following, in order to use PBR on the router. ADSL Modem 1 (/29 Ip block) ADSL Modem 2 (/29 ip block) Mid band Ethernet Tail (10m/10m) (/28 block)
Router ASA 5510 LAN Switch
I need your opinion on the following points
1. What is the best suited router considering i have 2 adsl connections and i will need 3 WAN + 1 LAN ports in total.
2. Where should I run the NAT ? on ASA or the router. (I do have around 20 L2L IPSEC VPN tunnel on the ASA). In the new setup I would like to use ADSL 1 for the internet browsing and use ADSL 2 and Ethernet Tail for incoming service (+some outgoing to specific destinations or based on specific services)
3. I have an old 1841 with 2 Ethernet ports, am i better off buying 2 x ADSL2+ cards and use them with expansion slots?
4. Both adsl connections are PPPOA based, Can I put both adsl modems into bridge mode and create pppoa connections on 1841? (I will still have to buy a HWIC 2 ports Ethernet card).
5. Should i go for any of the above options or am i better of buying a new router?
I have a cisco 1841 router which isn't able to boot properly from its IOS. it always prompt me on ROMMN.
Here it is:
System Bootstrap, Version 12.4(13r)T8, RELEASE SOFTWARE (fc1)
Technical Support: [URL]
Copyright (c) 2008 by cisco Systems, Inc.
PLD version 0x10
[Code]....