Cisco WAN :: Avaya G350 / QoS For Inbound Traffic

Sep 17, 2012

I have a remote office with a 1.54mb circuit connected to our private MPLS network.  Our main office has a 20mb conneciton to said network.  I want to set a QoS policy for traffic from the remote office to our Avaya subnet within the main office.  This policy is to give priority to all traffic to the Avaya G350.
 
I have set up the outbound traffic policy on our remote office router using a policy map as follows:
 
access-list 101 permit ip any 192.168.0.0 0.0.255.255 (this represents the Avaya subnet)
 class-map match-all voice_outbound
match access-group 101 
policy-map voip_outbound
class voice_outbound
   priority percent 50
 interface Serial0/3/0
service-policy output voip_outbound
 
This works fine for outbound traffic.  Now how do I give priority to inbound traffic from the 192.168.0.0 network?  When I try to do similar command it says CBWFQ is only configurable as output, not input.
 
I'd just limit it at the far end, but that has a 20mb pipe.  All other traffic from our corporate datacenter, as well as internet traffic, flows from the main office to the remote office.  Should I just rate limit everything else destined for the remote office subnet, and if so, what's the best method?

View 4 Replies


ADVERTISEMENT

Cisco LAN :: 2811 / Traffic-export Capturing Only Inbound Traffic?

Mar 19, 2013

We have a Cisco 2811 running ITP IOS.  On that router we run the SMPP service.  A client on the network connects to this service, and we need to capture the traffic for debug.
 
I've tried traffic-export, but I cannot see any outbound traffic.I'm guessing that this is due to the fact that the outbound SMPP traffic is not transit traffic as it is generated by the router itself.
 
Is there any way to capture the outbound traffic?

View 4 Replies View Related

Cisco :: Inbound And Outbound Traffic In BGP?

Dec 6, 2012

I have two ISP, I want to divide Inbound to ISP1 and Outbound to ISP2.

View 3 Replies View Related

Cisco Switching/Routing :: Inbound Traffic On 7606?

Jan 17, 2013

I have two Cisco 7606 routers using BGP to connect our customers to the internet.  Recently we added a new 1G circuit in addition to an existing 1G circuit and all traffic inbound is now on this new 1G circuit.  We would like to shift some of the inbound traffic over to the other 7606.  Our Tier provider has the same AS number for both paths.  One path goes directly to New York and the other goes to Boston then New York. 

View 1 Replies View Related

Cisco Routers :: RV110W Blocks All Inbound Traffic

May 28, 2013

CE IP - 172.18.10.10 /30PE IP - 172.18.10.9/30 I had configured some floating static route on the PE towards CE .The routes were installed correctly till PE - CE link was UP as next hop IP was showing as connected .Now the link has been removed and I am receiving a supernet of 172.16.0.0/12 from PE2 via MPBGP. Although the 1st static route for 10.10.0.0 is showing in routing table, the other 2 ( 172.17.0.0 & 172.24.0.0 ) donot show. I believe that as both the routes and next hop fall under the supernet , the static route is not installing. But I don't know why is this behaviour. I tried to remove the distance 250 from both the routes , but still the static route does not install. I tried this on GNS3 but got the same results .

View 14 Replies View Related

Cisco VPN :: Block Unsolicited Inbound Traffic Through L2L On ASA5505

Apr 6, 2013

I have a working L2L between two locations. Location A and Location B.
 
Location A: 172.16.16.0/24
Location B: 192.168.0.0/24
 
I would like to block anything inbound to Location A from Location B that isn't initiated from Location A. The block should be done on the ASA5505 at Location A. Location B uses an ISR G2 router. i.e. Location A can start an SSH session to a server in Location B Location B cannot start an SSH session to a server in Location. .

I tried using a VPN filter on the ASA5505 but it isn't stateful, I cannot pass any traffic when using it.
 
Config on my ASA:
 
access-list vpn-traffic extended permit ip 172.16.16.0 255.255.255.0 192.168.0.0 255.255.255.0
access-list block-vpn-to-local extended deny ip 192.168.0.0 255.255.255.0 172.16.16.0

[Code]....

I also have an AnyConnect VPN setup for the ASA5505 and it is running 8.2(5).

View 4 Replies View Related

Cisco WAN :: 1811 - Restricting SMTP Inbound Traffic

Mar 16, 2012

I use a mail filtering service that delivers mail to me via SMTP on standard port 25 on one of my 5 static external IP's. I wish to restrict this to their IP's only (they have two) and I am unsure on how to do so? As it stands now, anything on the net can talk to my mailserver and my logs are filling quickly with failed attempts as a result. Here's my setup and what I am trying to accomplish:
 
mail filtering service -> my public ip:25 -> internal mailserver at 10.0.10.2:25, deny everything inbound except traffic from the mail filtering service, I am thinking an ACL would fit the bill here, but unsure of how to implement. Router is an 1811 with version 15.1(4)M3 IOS. WAN is on fa0, lan is on fa1.

View 3 Replies View Related

Cisco VPN :: ASA 5580 / Inbound VPN Traffic From Vendor Over NAT IP Address

Dec 25, 2012

We have a L2L VPN with a vendor and our outbound traffic (our local network is 192.168.0.0) NATs over one of our public IP addresses x.x.x.164 to their public IP address 128.x.x.x. In the beginning all our traffic was outbound (port 23) to the vendor and now we need to allow inbound from the vendor to specific 192.168 addresses on our network using port 9100. I’m uncertain as to what I should do to allow their inbound traffic to these IP addresses since we are NATing our entire network over one IP address. Note, the .164 public IP is also used to NAT to other vendors we have L2L VPN with. The VPN terminates to our ASA 5580 version 8.2.

View 5 Replies View Related

Cisco Firewall :: ASA5510 / Inbound Traffic Being Blocked

Nov 7, 2012

I have an ASA5510 with 8.3 and a Cisco PIX525 (retiring). The ASA was for VPN traffic only while the PIX was for all other Internet traffic. I'm trying to move all the traffic to the ASA5510 so I used the PIX to ASA migration tool. I migrated the PIX rules over to the ASA5510, however we can't receive email and there is no external access to our internal websites. But the VPN connections remain intact and internal users can get out to the internet.
 
When I run Packet Tracer on my outside (incoming rules) the packets are dropped at the inside interface. What am I missing?

View 1 Replies View Related

Cisco WAN :: IP Spoofing And Redirect Inbound Traffic C3750

Oct 9, 2012

We want design a topology based on transparent proxies using WCCP. Our proxies can do spoofing of user ip addresses. So, the HTTP request will go out our network with the user ip address as source ip. The HTTP Response will arrive with destination address the user ip address. We want use WCCP to redirect inbound and outbound traffic because we have c3750 with L2 WCCP support. The outbound redirection, when the packet is going out our network is simple. But, the problem is the inbound redirection. How we redirect this packets to proxies by WCCP?. Is it possible?. This redirection is done by c3750 using TCAMs/hardware?. Our throughput could grow until 2-3Gbps and we are worried about the performance.

View 1 Replies View Related

D-Link DIR-825 :: Block Inbound Traffic From A Specific IP?

Oct 5, 2011

How to configure the 825 to block inbound traffic from a specific internet IP address ?i noticed an IP and MAC that i don't recognize that is listed as a connection to my NAS's media server ...i blocked it in the NAS configuration page, but i don't want any unsolicited traffic into my network.

View 3 Replies View Related

Cisco Routers :: RV110W - Firewall Blocking All Inbound Traffic

Apr 5, 2013

I have a RV110W that's been in service since Dec 2012. All Everything is working fine except every month or so the firewall starts blocking all inbound traffic. It does not respond to remote management access. If I reboot the firewall (pwr off/on) everything works correctly for the next month or so and then it begins blocking all inbound traffic again. Local access to the Internet and VPN tunneling are not affected. When it's working, all my rules and port forwarding work correctly.

View 2 Replies View Related

Cisco Firewall :: ASA 5520 Inbound Traffic On Backup ISP Connection

Nov 3, 2011

I have a client that has an ASA 5520 that has two internet connections, FIOS and Comcast.  The ASA is configured to failover from the FIOS to the Comcast if the FIOS fails.  This works perfectly fine.  However, I was wondering if VPN and other inbound traffic will come into the secondary connection when it is active.  I think VPN will work inbound when the FIOS connection fails, but I am not sure about the other inbound connections. 

View 1 Replies View Related

Cisco Switching/Routing :: ASA 5510 Securing Inbound Traffic On VPN Using ACL

Nov 1, 2012

I have a VPN on my ASA 5510 between (A)192.168.255.0/24 and (B)172.20.2.0./24. The purpose of the tunnel is to send kerberos tickets from our domian controller on the A side, across to a server at B, and receive a respose. I want to lock down inbound traffic to the A network, but not sure of best method.
 
I initially tried using an ACL filtering on ports, but soon realised the incoming traffic uses a wide range of ports so this is not really possible.Seeing as the A side will always be initiating the conversation, I was wondering if I could use the 'established' option on the inbound ACL for the ASA at A side, so that it would block any flows that are not initiated by the A side.

View 3 Replies View Related

Cisco WAN :: 2811 Remove Access-list Applying To Inbound Traffic

Dec 25, 2012

I have been trying to figure out a NAT issue on my 2811 and the inspect engine.I have 'ip inspect FW out' on my outside interface. If I turn it off, I also have to remove the access-list applying to inbound traffic on that same interface. Why is that? This whole thing centered around SIP registrations from devices on my LAN to my provider. The provieder is showing that I am registering from a high end port (1024 or something crazy). He said that it sounds like some type of SIP ALG or something on my router. For the life of me, I can't figure out what would be causing it. I am just using a standard route-map that points to the outside interface using 'overload'.

View 6 Replies View Related

Cisco WAN :: Limited Inbound Traffic To 3 Mbps On Router's Interface 1800

Jun 22, 2012

I have two 1800 routers running VRRP. Also I have two sub interface configured on both router and both router connected to swith through thunk link. My goal is to limit inbound traffic to 3Mbps for both VLANs on router's inside interface which is connected to switch.

View 1 Replies View Related

Cisco Switching/Routing :: Switch 3750 / Policy Inbound Traffic Per IP?

Mar 2, 2012

We are using Cisco 3750 switches in our environment as distribution switches.We currently use to police inbound traffic, but we need to find a solution to limit inbound traffic per IP.Something like this “Inbound traffic for each IP can be maximum 1 Mbps” This can be done having, one ACL and one class-map for each IP, but in my situation is not a practical solution, because we have more than 500 IP’s on that site.
 
Is any way to accomplish this without writing 500 ACLs and 500 class-map?

View 2 Replies View Related

Linksys Wired Router :: BEFSX41 Creating Inbound Traffic Policy?

Feb 12, 2010

BEFSX41 V2.1
Firmware: 1.52.16
 
The manual states how to create an inbound traffic policy but if you follow the directions there is no place to select inbound traffic.From the manual: To Create an Inbound Traffic Policy1. Enter a Policy Name in the field provided. SelectInbound Traffic as the Policy Type.2. Enter the IP Address from which you want to block.Select the Protocol: TCP, UDP, or Both. Enter the portnumber or select Any. Enter the IP Address to whichyou want to block.3. Select Deny or Allow as appropriate.4. By selecting the appropriate setting next to Days andTime, choose when the Inbound Traffic will be filtered.5. Lastly, click the Save Settings button to activate thepolicy.When finished making your changes on this tab, click theSave Settings button to save these changes, or click theCancel Changes button to undo your changes.I want to filter out a range of ip addresses from trying to connect to my network.

View 3 Replies View Related

Linksys Wireless Router :: E2500 Block Outbound And Inbound Traffic On TCP 5222 / 5223

Oct 23, 2012

I am trying to block outbound and inbound traffic on TCP 5222 and 5223 on E2500 but cannot figure out how. The reason is I have kids in my house using KiK (texting app) on iPads, iPods etc.  My goal is to eliminate this applications ability to function for ANY wireless device connected to my WLAN. 

View 1 Replies View Related

Cisco VPN :: ASA5520 - How To NAT Inbound Traffic From Site To Site VPN

Oct 31, 2011

I have an ASA5520 and need to set up multiple VPN's to some vendor sites. All these vendors are using 192.168.1.0 networks. All have public IP's and very little knowledge so are unable to NAT from their end.The idea is to create some /28 blocks of IP's (172.29.0.0/28) and manage this on our end.
 
How do I get this to work?  
 
example: (all IP's are fictional)
 tunnel1 
VPN
My side "outside" 10.10.10.10
Their side "outside" 20.20.20.20
 Networks
My side "inside" 172.30.30.0
Their side "inside" 192.168.1.0 NAT'ed to 172.29.0.0/28

[code]....

View 3 Replies View Related

Cisco :: Avaya Phone Won't Talk With Server?

Apr 17, 2013

When I place the phone on a different subnet, registration failed. The connectivity between the two subnet should be working because I have a desktop computer hook up behind the Avaya phone and the computer can talk with the server without problemThe phone has gotten the IP from DHCP server can I can even ping the IP from phone server. but on the phone it shows "Discover 10.0.10.10" then reboot, again and again. 10.0.10.10 is the IP of phone server. And there is no firewall rules blocking the traffic between the two subnet.Like I said before, if I place the phone on the same subnet as the server it worked. The setting of the switch remain unchanged

View 3 Replies View Related

Cisco AAA/Identity/Nac :: ISE 1.1 Authentication With Avaya / Nortel Switches

Aug 21, 2012

Currently using Cisco ISE 1.1 to authentication both dot1x and mab from Cisco switches. Both features are authenticating properly.When we use a Nortel/Avaya switch for the authenticator, we are unable to authenticate using mac bypass (non-eap (or neap) in Avaya talk..). The correct authentication policy is found in the ISE, but the mac address is not found in the database. We know it is there because the same mac is authenticating with the Cisco switch. Dot1x authenticates properly from both the Cisco and Avaya authenticators. Could this be an issues with the username/password format in the Radius packet from the Cisco?  

View 5 Replies View Related

Cisco Switching/Routing :: Trunking Avaya POE To 3750X

Apr 10, 2013

Attempting to trunk an Avaya POE switch to a Cisco 3750X switch. Here's the Cisco port config: [code]
 
 Cannot PING Avaya switch at 10.89.0.5. I have Cisco switches at .1,.2 and .3. I can PING those and access them. Any additional config needed on Cisco trunk port?

View 1 Replies View Related

Cisco Switching/Routing :: How To Configure 3560 For Avaya IP Phone

Nov 15, 2011

how we can configured 3560 for Avaya IP phone ? , we would link to use voice and data connect to the same port

View 1 Replies View Related

Cisco AAA/Identity/Nac :: ISE 1.1.2 Change Of Authorization With Avaya Switches (5520)?

Jan 27, 2013

I am configuring ise to do the posture assessment. I am having avaya as my LAN and Core switches. The idea is once the user is authenticated using 802.1x then it will be moved to qurantine vlan and after it is compliant with the company's policy then it will be moved to the actual vlan. I have configured the avaya switch to accept the radius assigned vlan and also configured the 802.1x dynamic-authorization. Currently, radius assigned qurantine vlan is working but once the nac agent scan and mark the PC status as Compliant then the CoA is not happening and User is not moved to the actual vlan.
 
I tested the same ise authorization policy of dynamically assigning VLANs on cisco switches and it worked perfectly, but the same is not happening on avaya switch.

View 1 Replies View Related

Cisco Switching/Routing :: Connecting 3750 Switch To Avaya Environment

May 3, 2012

I'm introducing a Cisco 3750 switch into a Avaya environment for testing/lab. I'm concerned about any STP, VTP problems I might create as I'm going to give a address on the Management VLAN and connect it to a trunk port on a ERS5520 Avaya. I've set the switch to transparent mode and the VTP revision is set to 0. I've checked the STP priority but it doesn't give any - there is no output because it is not connected. I wouldn't be so concerned but, I'm not sure if any config has been on it before.Also, is there any way for me to see the STP prioroity without having it connected? 

View 10 Replies View Related

Cisco Switching/Routing :: Spanned Etherchannel ASA 5585X And Avaya VSP9000?

Apr 7, 2013

We have a pair of ASA 5585X firewalls that need to connect to a pair of Avaya VSP9000 switches.  The Cisco docs refer to doing spanned etherchannel with a Cat 6500 switch using VSS or a Nexus switch using VPC.  Does spanned etherchannel work with non Cisco switches or is this proprietary?  The etherchannel on the ASA is setup using LACP.  Here's applicable configuration:
  
interface TenGigabitEthernet0/6
channel-group 2 mode active vss-id 1
!
interface TenGigabitEthernet0/7
channel-group 2 mode active vss-id 2
!
interface Port-channel2
port-channel span-cluster vss-load-balance

View 3 Replies View Related

Cisco Switching/Routing :: 3750 - Avaya Phone Switch Port Configuration

May 29, 2013

Since Avaya phones do not run CDP, how does the phone know which DHCP pool to pull from to get its IP address if the PC is connected to the phone.
 
Let's say I have a interface config like this 
interface gigabitethernet1/0/1
cisco3750(config-if)#switchport mode trunk
cisco3750(config-if)#switchport access vlan 126
[code]....
 
And two DHCP scopes configured on the switch. What keeps the phone from pulling from the wrong scope?

View 2 Replies View Related

Cisco VPN :: Site To Site VPN Between ASA 5520 And Avaya VPN Phone

Oct 1, 2012

I am configuring Cisco ASA 5520 site to site vpn with Avaya VPN Phone? According to Avaya, the Avaya 9630 phone acts as a VPN client so a VPN router or firewall is not needed.

View 3 Replies View Related

Cisco Firewall :: Inbound UDP Connection 684?

Apr 25, 2012

Trying a simple Easy VPN connection and getting the following in the error logs:
 
Built inbound UDP connection 684 for outside:xx.xx.xx.xx/1106 (xx.xx.xx.xx/1106) to identity:xx.xx.xx.xx/500 (xx.xx.xx.xx/500)

View 1 Replies View Related

Cisco Firewall :: 5510 - Inbound NAT On ASA 8.4?

Aug 6, 2012

I am trying to setup an inbound NAT on an ASA5510 running 8.4 code.
 
object network obj-192.168.1.2
host 192.168.1.2  (internal web server)
 object network NAT-external IP
host ** external IP ** 
object network NAT-external IP
nat (outside,inside) static 192.168.1.2 service tcp https https
 access-list outside_access_in extended permit tcp any host 10.2.0.10 eq https
 
This seems to be setup now?
 
sh nat
2 (outside) to (inside) source static NAT-*.*.*.*  192.168.1.2   service tcp https https
translate_hits = 0, untranslate_hits = 0
 sh access-l
access-list outside_access_in line 2 extended permit tcp any host 192.168.1.2 eq https (hitcnt=27) 0x59383a04
 
When I try to connect to the external IP using https I get hits on the access list, however the nat translate hits do not go up?Do I need to allow the 192.168.1.2 server back out again?

View 1 Replies View Related

Cisco Firewall :: ASA5505 - ACL For SMTP Inbound

Dec 29, 2011

I am trying to configure my ASA5505 to allow SMTP relay and the ACLStatic I created is not working.

View 1 Replies View Related

Cisco Firewall :: Dual ISP And Inbound NAT ASA5505 8.2

Oct 30, 2012

I have setup an ASA5505 running 8.2 with dual ISP's
 
Primary link is the current live static route out and the backup picks up if the primary fails. That all works great However I have an issue with inbound NAT rules
 
I have configured an inbound static on the primary which works great
 
static (inside,primary) *.*.*.* 10.1.1.1 netmask 255.255.255.255 access-list outside_access_in line 2 extended permit tcp any host *.*.*.* eq 3389 (hitcnt=4)
 
Question? With the primary link active and the default route pointing out through the primary, am I able to configure an inbound NAT to the same inside host 10.1.1.1
on the backup link?
 
If the primary fails users will need to be able to connect inbound to this service
 
When I try to set it up I got this error ERROR: Static PAT using the interface requires the use of the 'interface' keyword instead of the interface IP address
 
So I tried that and got this error WARNING: All traffic destined to the IP address of the backup interface is being redirected. WARNING: Users will not be able to access any service enabled on the backup interface.
 
So what is the best practice for configuring inbound NAT for a dual ISP configured ASA

View 1 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved