i have 1001 ASR which boots up ok but shows a warning "filesystem is not clean" and thereafter the image is validated well, it shows up the following two messages and just goes idle from there. [code]
View 6 RepliesWe do some remote work for our customers and often have to use their VPN in order to connect to their systems. We have had no problem utilizing the Cisco VPN with some of our customers unti recently. We picked up another customer that uses the Sonicwall VPN. If I sign onto the Sonicwall client, sign off, and sign into the Cisco VPN client, at the point that it makes the connection, it completely locks up my users' PCs. It happens to all of them.
I've discovered that from a fresh boot, I can get on and off the Cisco VPN all day, but as soon as I utilize the Sonicwall VPN, and then return to the Cisco VPN, it locks up every time.
All of my machines are Windows 7 and are using the Cisco VPN Client Version 5.0.07.0290.
I've got a RV220W that for some reason has started acting a bit strange. A couple of times a day the network stops functioning, both wireless and wired. At first I thought this had to do with my newly installed laptop, that it maybe caused some hickup that made the router reboot but even when it's turned off I can still read in the logs of my NAS server (Qnap TS-419P+) that "Lan 1 is down" followed by a "Lan 1 is up" a couple of minutes after.
The things connected to the network by wire is my Macbook Pro (2012), the Qnap and an LG home theater system and the wireless devices are a couple of iPhones and an iPad. The problems started after new years eve and I've been running the latest firmware (1.0.4.17) for a few weeks before that.
So we have this problem that just started, I can replicate the issue as well, if a user makes a mistake on typing there password after 1 attempt ACS sends 3 to AD locking out the user.
In a putty or secureCRT session after 1 password failed attempt, I am unable to retry with that same session.
The issue seems to be that after 1 bad password attempt, from the client side I am unable to get another try.
I can't seem to find any documentation to how to get this working. I'm trying to make it so that only users of a certain AD group are authenticated for my Anyconnect VPN on my ASA 8.2.2
I've found the documentation on how to prevent logins using the msNPAllowDialin attribute, but not how to base it on group membership (memberOf) [code] I need to do any kind of restrictions inside the actual group-policy TESTGROUP ?
I have the main router, which is SMC SMCD3GN from Rogers in Canada, and I have heard from MANY people that this router REALLY sucks..especially the range. And I myself also had problem with low signal in the 2nd floor of my house, so I purchased the wifi repeater (TP Link) to extend the range. I followed the guide given in the box, and everything was set up flawlessly. However, after a few hours of use, all my devices (laptop, tablet, phone) which are in the same room as the repeater decrease the signal again, to the point where it was before I purchased the repeater. Then if I disconnect the wifi and reconnect, the signal is full again. Sometimes I have to unplug the repeater from the wall and replug in order for it to work.
View 2 Replies View RelatedI am having issues with my freinds new DIR-825 Rev:B1 Firmware:2.02NA, The admin pages are intermittently slow to load and sometimes wont load until I power cycle the device. I am using IE8 on vista x64, and have the issue on all pc's on the network. Is there a work around for this?
View 7 Replies View RelatedJust upgraded from the base card to a Intel Centrino 622ANHMW 6200 wireless half mini card. The added speed is great, but the 1750 is locking up frequently. I installed the recommended drivers and install went fine.
View 3 Replies View RelatedHad a Sev 1 issue today. We have a bunch of Nexus 5ks connecting to some HP C7000 Chassis for the use of Virual environments. Engineers build and tear down servers during the day, however today, an engineer configured a virtual machine accidently with its IP address as the default gateway. Each pair of nexus switches has one physical SVI per vlan and a HSRP address for the vlan. Of course this engineer configuring the server IP address as the HSRP address killed the vlan... which lead me onto think... are they are tried and tested techniques to protect this from happening on the switch. Enforcing the ARP/MAC of the HSRP address and not allowing it to change or any other device to change it?
View 2 Replies View RelatedWe need WiFi security on our corporate SSIDs locked down using certificates, we are using wlc cisco 2100 series. We need these on every workstation, laptops etc.
View 6 Replies View RelatedI've an ASR1001 with 15.1(2)S code on it connected to out ISP, we've been get some complaints about performance and I'm seeing drop on the output policy. Checking the bandwidth consumption we have plenty spare when drops are occuring, there's 300Mb/s. Details below, any suggestions gratefully received
The policy is to guarantee the following bandwidth:
Outbound policy:
class 1 => 50% guaranteed
class 2 => 8% guaranteed
class 3 => 1% guaranteed
class 4 => 5% guaranteed
class 5 => 1% guaranteed
class 6 => 5% guaranteed
class => 7% guaranteed
class 8 => 7% guaranteed
class default => not configured
config :
policy-map priority
class 1
priority percent 50
class 2
priority percent 8
class 3
priority percent 1
class 4(code)
I just would like to confirm if the ASR 1001 with IP Base license can support the normal BGP features such as remote-peering IPV4, Local-AS.
I am not looking for advanced features such as Route Reflectors, VPLS, L2 VPN, etc.
We are going to purchase ASR 1001 with ipbase, BGP is our basic requirment if we purchase ipbase(SLASR1-IPB) it will support BGP.
ProductDescriptionASR1001Cisco ASR1001 System,Crypto, 4 built-in GE, Dual P/SASR1001-PWR-ACCisco ASR1001 AC Power SupplyCAB-IND-RAPower Cord India, Right AngleSASR1001UK9-32SCisco ASR 1001 IOS XE - ENCRYPTION UNIVERSALSLASR1-IPBCisco ASR 1000 IP BASE LicenseM-ASR1K-1001-4GBCisco ASR1001 4GB DRAM
is the ASR 1001 either with IDC OC3 or T3 support VPLS and what is the limitation, what is exactly support is it full functionality of VPLS?
View 4 Replies View RelatedI just need to start building the configuration of an ASR 1001 but I do not know how gigabitethernet interfaces are named on these routers? Are Gi0/0/X or Gi0/X ??
View 1 Replies View RelatedI am replacing my 2900 Internet router with a ASR 1001. I am really not doing anything to fancy on the configuration just routing traffic from the internal LAN to our ISP connection. With the new ASR 1001 there is a configuration for VRF Definition Mgmt-Intf do I do anything with this? There is also a interface for vrf forwarding. At this point we are just running IPv4. The plan was just to configure the GigabitEthernet interfaces but I wanted to make sure if I should try and configure VRF.
View 2 Replies View RelatedWe have an existing WAN connection from a Cisco 2821 router to Time Warner with a single mode fiber connection using the following SFP:We have a ASR 1001 router configured to replace the 2821 router. When I connect the fiber into the ASR 1001 router the link does not come up. I have used the above SFP without success and the following SFP.I have seen Cisco documentation that only certain SFP modules are compatible with ASR router, but I believe the second SFP I listed is compatible. As a test, I connected my ASR router to a 3750 switch using long haul SFP modules on each end so I know the SFP module works. The only downside to this test is I only had a multi mode patch cable. Are there specific settings on the ASR interface that need to be set to allow this connection?
View 1 Replies View RelatedI have an issue with an ASR 1001. The problem occurs with MQC shaping applied to a gigabit interface in the outbound direction. The CIR of the provider we are using is 100Mb/sec, so we are shaping to that value. However when reported traffic levels are about 60Mb/sec, we see a steady increase in output drops. [code]
I have also tried increasing the hold queue, however this does not work with the drops. Increasing the shaping rate to 200Mb/sec gets rid of almost all the drops (not quite all!) but is not what we need. I think that we should see some drops when rates spike above 100mb, however the amount we are seeing seems excessive?
This would be the first time I will be working on NCS for a client. There is completely a new install and I was just doing my reading to get my head around the overall working of the product. I had a small Q in mind which I wanted to ask here, while going the config guide, i could not find the way to add a router to the NCS prime. W have ASR 1001 in use along with switches. I read in some forum that NCS supported routers but couldnt find the way in the config guide unless i am missing somewhere. The NCS version is 1.0
View 6 Replies View RelatedWe have problem con EIGRP and two ASR 1001 in High Availability. ASR2 have received all route (100 route) from PE, but in ASR1 doesnt received all route (75 route) from PE or from other ASR02. All PE have all route. The ASR1 when modify or lost some route dont update to the ASA. see diagram.
View 5 Replies View RelatedI have a need to capture traffic on an ASR 1001 subinterface, but what I have found is that the Embedded Packet Capture feature is not supported on this platform. Are there any simple alternatives to capture egress traffic on a subinterface or am I SOL? This is a walk in the park on normal IOS routers...
View 1 Replies View RelatedWe've recently bought a cisco asr 1001 Router and I have a number of interface slots. I want to populate these with fiber modules.
Which fiber modules are compatible? Are the regular SFPs ok to use or is there a special asr series of SFPs to use?
I'm trying to configure Tacacs on Cisco ASR1001, and the Tacacs server is Cisco ACS v3.3, the ACS won't pass the authentication, complaining bad request from NAS, key mismatch - which I compared millions of times on both ASR and ACS sides. [code]
View 2 Replies View RelatedA customer recently purchased an ASR 1001 under the impression it could replace their old 3662 router and ASA 5505. The ASA is configured for their SmartFilter proxy server (N2H2), and I am having a heck of a time finding any documention on how to configure this. I found the following: To use SmartFilter with Cisco IOS firewall, install the SmartFilter componentsand use the IFP plugin (off-box). To configure the Cisco IOS for SmartFilter,use the Cisco document Firewall N2H2 Support located on the Cisco Web site,[URL]Well, I found the Firewall N2H2 Support document [URL], but the ip inspect command doesn't seem to work on the ASR. Is there any way to make this work or does the ASA have to stay in line?...
View 3 Replies View RelatedHow can i find the list of features supported in ASR for various license
1) IP Base
2) Advance IP Services
3) Advanced Enterprise Services.
i want to apply a QOS for my trafic LAN, in my ASR 1001 , the LAN is connected with ge0/0/0 interface and it configured with the service instance to bridge vlan 1 ( i do that for OTV ) i put service policy in "service instance 1" to marking data with ef31 but i noticed that the class "plateform_datacenter" match the trafic and the ACL associate to this class not mach any trafic trafic !
tha policy-map march trafic for Datacenter :
sh policy-map interface gigabitEthernet 0/0/0 service instance 1
GigabitEthernet0/0/0: EFP 1
Service-policy input: MARKING-OTV
Class-map: Platforme_DC (match-any)
[code].....
I have problems to configure CBWFQ on a ethernet sub-interface on a Cisco Router ASR 1001. Then I applied the policy in the physical interface but it should be is in the sub-interface. How can I configure CBWFQ on sub-interface in ASR 1001. (version 3.02).
Error Messages:
CBWFQ: Not supported on subinterfaces and efps
This the final output:
interface GigabitEthernet0/0/0
description Conexion WAN
bandwidth 153600
no ip address
load-interval 30
no negotiation auto
[code]....
My company has purchased a second ASA for fail over reasons and I'm needing to attach it to my core router (ASR 1001). Currently I'm running the connection between my ASA and my Core as a /19 ie. ASA-10.10.10.2/19 -- ASR-10.10.10.1/19. I know the 2nd interface on the ASR will need to be on a different network segment then the first connection (10.10.10.1/19). What would be the best way to segment this out with out breaking up my /19?
Run /30 segments for each interface? Use a VLan ?
I don't want to use up my Internet rout able IP's on /30 segments. Attached diagram.
when i make a trace route on an ASR 1001 router to 172.23.30.7 I get the following output:
VRF info: (vrf in name/id, vrf out name/id)
1 192.168.99.192 0 msec
192.168.99.191 1 msec
192.168.99.192 0 msec
2 172.23.30.243 1 msec 1 msec 1 msec
3 172.23.30.7 1 msec 1 msec 1 msec
Is there a loop between 192.168.99.191 and .192 (this are two routers with hsrp .190) or is this normal behavior when using trace route on an asr 1001?
I am migration an IPsec site to site VPN config to a new ASR1001 router «facing» a Linux box (ipsec-tools + racoon). As the Debian Linux does not offer VTI, I am using a crypto map.
The working config is given below with the corresponding logs on the Linux side.
When I try to apply this previously working config to the ASR1001, I get the following error :
000855: *Dec 12 18:28:21.859 UTC: %ACE-3-TRANSERR: IOSXE-ESP(14): IKEA trans 0x1350; opcode 0x60; param 0x2EE; error 0x5; retry cnt 0
Dec 12 18:50:19 FAKE-AUCH-GW racoon: INFO: initiate new phase 1 negotiation: 194.214.196.2[500]<=>130.120.124.8[500]
Dec 12 18:50:19 FAKE-AUCH-GW racoon: INFO: begin Identity Protection mode.
Dec 12 18:50:19 FAKE-AUCH-GW racoon: INFO: received Vendor ID: CISCO-UNITY
Dec 12 18:50:19 FAKE-AUCH-GW racoon: INFO: received Vendor ID: DPD
Dec 12 18:50:19 FAKE-AUCH-GW racoon: INFO: received Vendor ID: draft-ietf-ipsra-isakmp-xauth-06.txt(code)
deploy OTV using ASR 1001 between 2 data-centers? We want to acquire HSRP localization there, but at this moment I can only see lots docs are saying how to do this on N7K, not ASR. I saw it has a FHRP filtering enabled by default when the OTV configuration is done, and also see there is a access-list created by default call otv_filter_fhrp, Im just wondering besides this IP ACL there should be MAC ACL applied?
View 3 Replies View RelatedI have a few new ASR 1001s throwing false environmental alerts.According to the logs, the inlet temp is in excess of 100 degrees C.When I telnet to the routers, they're well within tolerance (30-32C),Running 15.1(1)S and bug toolkit shows no related issues or caveats.
View 1 Replies View RelatedI have a Linksys WUSB54G version 4 adapter.My computer is running Windows XP, Service Pack 3, which is automatically updated at all times. I've been using the adapter for a year with no problems.
Suddenly, it's started loosing the connection to the Linksys router and locking up my computer so only a hard re-boot power-down will work.When it comes back up, some or all of my cookies are lost.
I've run several different security packages but no virus or other issues have been found.I've uninstalled the adapter and reinstalled it.Last time, following something I read on this site, I installed it without the Linksys software, just the drivers.