I have applied named access-list in output direction on 1GE interface on GSR12400 (IOS XR 3.4),but there is no matches. Counters doesn't increase although access-list blocks or permits certain packets (access-list works as it should).
View 2 Replieswe have a 878 router and we want to mark traffics when entering on its lan interface.its lan interface is a layer 2 interface and we have created vlan interface and assosiated lan interface to that vlan.on vlan interface itself there is no service-policy command so we have to put serive-policy command on interace fast 0 itself which is layer 2 port.when we assign service-policy to fast 0 it doesnt work and it does not mark any traffic also class default counters doesnt increase to indicate any traffic is passing even it is not getting marked. ios version is advipservices.124.9T. How to mark traffic on this port. ii dont know why service-policy command is supported on layer 2 interface when it doesnt work at all.
View 3 Replies View RelatedI'm getting this error message on syslog server (Kiwi syslog)access-list logging rate-limited or missed XXXX packets i did the following commands but still I'm getting the error :logging buffered 16386 debugginglogging rate-limit all 5000no logging consoleno logging monitorip access-list logging interval 30000ip access-list log-update threshold 30000 i don't want to report to the console or monitor i want to report direct to syslog server, because I'm monitoring all the traffic (permit ip any any log) !
View 2 Replies View Relatedi have a netgear wndr3400v2 on windows 7 ulitmate and when i go to [URL] and try to find the setup access list option it doesnt show up but they say its suppose too
View 1 Replies View RelatedI am trying to remove a line in a particular access-list configured in a FWSM module using this command "no access-list <acl> line 19 x x x x" but it doesn't work. See below:
FWSM/xxx03(config)# no access-list ?
configure mode commands/options:
alert-interval Specify the alert interval for generating syslog message
106001 which alerts that the system has reached a deny
[code]...
How can I remove a line from the access-list without clearing the entire access-list?
As the topic states, the wireless card finds the signal without issues, but then does not transfer any packets after it connects. Only one computer is having this issue, all others connect perfectly fine. Also, there was no significant change to the computer recently, the problem seems to have sprung about randomly.
[code]...
i have a avraetec 2200 sereis wich has a amd turion65 processer with windows xp professional and one day the internet didnt work and i looked at the activity it said aquiring network adress and it said sending packets but not receiving and its not a problem with wireless because i conected directlty to the modem and i had the same probem and also there are other devices conected to the modem and they hav
View 1 Replies View RelatedI have two cisco 2821 routers (12.4(3a)) doing IPSec and I would like to graph (using SNMP) some counters which are shown using "show crypto engine accel stat", however, I have not been able to find which MIB resp. OID I need to acces.
View 9 Replies View RelatedHow to approach an overnight upgrade from autonomous AP1231/1242 deployment into a 2504 controller-based AP1602 deployment.I do not have access to the existing 1231/1242 deployment ==> I need to ask network manager for all necessary config info to be ported onto the 2504.Example: the 1231 show run output does not list the various SSID that are in use.Therefore the question is: which commands' output do I need to ask to have all possible config data from 1231/1242 to use when configuring the 2504/1602 deployment.
View 2 Replies View RelatedI'm having big problems with my Linksys WAG320N. I'm pretty clueless when it comes to networking.Without changing any of the settings, the other day my Macbook Pro couldn't connect and it kept saying 'Connection timeout'. From that point my iPhone also refused to connect, although accessing the internet on my MBP via Ethernet was fine.
I did a hard reset following instructions from this forum then re-configured with the installation CD. The wireless LED on the router was lit but my MBP couldn't see the network. Eventually I managed to connect after rebooting my laptop, and enjoyed all of 10 minutes of problem-free of wireless internet connectivity before the network just dropped out and now doesn't show up in my list of networks again, although the wireless LED is still on. Connecting via Ethernet still works, just not via wireless.I've rebooted my laptop and the router and tried switching channels on the router, all to no avail.
I have tried to setup access control by setting up a policy that restricts certain MAC addresses during a period during the day from certain websites. I set up the website filter and a schedule and selected them for the policy. Instead of blocking just the websites on the filter list during the time setup in the schedule, it blocks all websites all the time.I made sure that I setup the policy to 'block some access' NOT 'block all access'.The only thing that seems to work is that only the computers with the MAC address selected are effected.
View 3 Replies View RelatedI recently bough for a home lab a sg300-10 switch. I have enabled layer 3 routing on it and have come across a puzzling issue. The switch is the default gw on this network, and in front of the switch there is a cable modem (ip route 0.0.0.0 0.0.0.0 192.168.0.7).
This is my config:
config-file-header
switch5ed948
v1.2.7.76 / R750_NIK_1_2_584_002
[Code].....
I have a newly aquired asa 5505 that I just set up to the bare minimum configurations. I followed a cisco paper on how to create a "remote access vpn" setup for ipsec. I can sucessfully connect and establish a VPN, but when I try to access an inside resource from the vpn address, the asa blocks it.
Specific error is:5 May 09 2012 15:17:48 305013 192.168.1.2 80 Asymmetric NAT rules matched for forward and reverse flows; Connection for tcp src outside:192.168.1.220/53101 dst inside:192.168.1.2/80 denied due to NAT reverse path failure
Here is my config.
: Saved:ASA Version 8.2(2) !hostname asawooddomain-name wood.localenable password W/KqlBn3sSTvaD0T encryptedpasswd W/KqlBn3sSTvaD0T encryptednamesname 192.168.1.117 kylewooddesk description kyle!interface Vlan1nameif insidesecurity-level 100ip address 192.168.1.1 255.255.255.0 !interface Vlan2nameif outsidesecurity-level 0ip address dhcp setroute !interface Ethernet0/0switchport access vlan 2!interface Ethernet0/1!interface Ethernet0/2!interface Ethernet0/3!interface Ethernet0/4!interface Ethernet0/5!interface Ethernet0/6!interface Ethernet0/7!boot system disk0:/asa822-k8.binftp mode passivedns server-group DefaultDNSdomain-name wood.localobject-group service rdp tcpdescription rdp accessport-object eq 3389access-list outside_access_in extended permit tcp any interface outside eq 3389 access-list outside_access_in extended permit tcp any interface outside eq 8080 access-list outside_access_in extended
[code].....
I have installed a new ASA5510 with CSC, and everything is working properly except the access to websites using https. All sites/access to them seem to be blocked by the ASA. I have read that this access is by default enabled and I have tried to add configuration to allow https access to the firewall but without success. [code]
View 6 Replies View Relatedi have router lynksys WRT120N and the latest 1.0.0.7 firmware. And the problem occured frequently. At about 13.00 i went out, wifi was working okay. At around 18.00 i returned home and i was trying to connect to the wifi with my android phone, and suprisingly it did not work. I tried on my laptop and on a android tablet. It did not work. The only thing that i could figure it out is to reset the router. I checked the settings, and there was no access policy e.g. time based access blocking.
View 5 Replies View RelatedI have a Cisco RV042 Wired Router. I've got a static IP and a MS Small Business Server in my Router Network. I have forwarded the essential ports to use the IIS and the Exchange Server of my SBS2011 (HTTPS, HTTP, smtp, rpc). I have also created some access rules for these ports, but I don't have any access on my server services, if the firewall is activated.
Here are my Firewall Access Rules from the RV042 Web Interface:
I'm using my 655 as a WAP, so nothing is connected to the WAN port. Since I run a SBS2008 in my home, I also have the 655's DHCP disabled.If I enable Network Filtering, everything inbound/outbound on the LAN ports works except accessing the Admin page. Even if I put the connecting PC's LAN MAC in the tablet.
View 9 Replies View RelatedI am trying to allow telnet to port 551 but i couldn't get it to work.I am using a cisco 1720 router running on IOS 12.2.I am using the below commands to set the access list to allow access to port 551 using remote telnet to the Cisco router.hostname R1!interface ethernet0ip access-group 102 in!access-list 102 permit tcp any any eq 551.After i enter the above command the router will disconnect me and i will not be able to connect to it for awhile. Once the router is up i am still unable to telnet to port 551.
View 14 Replies View RelatedI have a WAP4410N access point. In the datasheet, it shows that the Antenna Gain in dBi as 2. I need to increase the range of the access point by replacing the antenna with a 7dB one. I would like to know the maximum dBi supported by this access point.
View 0 Replies View RelatedI have a WAP54G and the signal strength and range is not that great; unit manufactured in 04/2007. I have firmware version 3.04 dated Oct 31, 2005. Customer support is suggesting I upgrade the firmware to 3.04.03 but I am sure it will really do anything to the signal strength and range. Also, they suggested I download new drivers for my desktop wireless card.
View 9 Replies View RelatedHow to implement mac access-list in 881 and 892 router ? As you now that we can get additional switch-port in the same router but I can't see the function in this router. I guess the switch port must function like the catalyst 2960 switch.
View 3 Replies View RelatedI'm creating an access-list that will contain all networks and host that will be redistribute into EIGRP.Till now, this access-list contains 72 entries but this number can increase anytime.
I'm using a 3750-x layer 3 switch, and I'm wondering how big this access-list can be, regarding CPU and memory utilization and performance.
we installed a cisco router in a school with two vlans (VLAN 1 & VLAN 2) VLAN 1 is for teachers and Admin and VLAN 2 is for students. We want so that VLAN 2 shouldn't be able to access any device in VLAN 1 but VLAN 1 should be able to access all devices in VLAN 1 & 2
VLAN 1 192.168.11.0/24
VLAN 2 192.168.12.0/24
I am using VLAN interfaces. I know we have to use some access lists but if i apply
access-list 100 permit ip 192.168.10.0 0.0.255 any
access-list 100 deny ip 192.168.12.0 0.0.0.255 192.168.10.0 0.0.0.255
With this access list two subnets can not access each other. How these access list should look likes ?
I was reviewing some old configs at work today and noticed somthing weird in the access-lists. What is this?
View 6 Replies View RelatedCreating an Access Control List
View 2 Replies View Relatedso far i also knew that if u assign an access-list to an interface:
for example:
int vlan1
ip access-group 150 in
and the access-list does not exist in the configuration it will block everything meaning it will be an implicit deny empty access-list but lately i've noticed on new routers that its different,if i assign an acl to an interface where the acl doesnt exist in the configuration it acts as permit all,
this is a project and my configred file:I can't config access list according to the project.
View 19 Replies View RelatedHow to apply access list on Vlans ?
my Scenario is
13 Vlans in cisco 3560 switch (Vlan 10,20,30........ 130)
vlan 10 ---- ip range 192.168.10.0/24 interface vlan 10 ip add : 192.168.10.1
vlan 20 ---- ip range 192.168.20.0/24 interface vlan 20 ip add : 192.168.20.1
here i want to block vlan 10 access to vlan 20 i created extended access list deny ip 192.168.10.0 0.0.0.255 192.168.20.0 0.0.0.255
and applied in interface vlan 10 as out now i cant able to access any host in vlan 20 (host 192.168.20.1) but i can able ping vlan 20's gateway 192.168.20.1
I have a question about access-lists on ASA: (5520 running 8.4)Often I want to permit all traffic from networks behind an interface (let's say DMZ in this example) to Internet, but NOT to internal networks. Then I first configure a Deny from DMZ to all internal network and then a Permit to ANY. If I forget the first Deny I will allow all traffic also to my internal networks. Is it possible to configure an access-list that permit all traffic from a network to all networks that are reachable via a given interface? In this example: Permit all traffic from DMZ to all networks that are reachable via the Outside-interface? This should permit traffic to Internet and deny traffic to internal networks in one statement.If I specify the outside-interface as the destination only traffic to the interface itself will be allowed.
View 1 Replies View RelatedI reported a really strange issue on a Cisco Router 3945. Here below info about release software used: [code] Please look at a brief extract of router running configuration file: [code] It’s an easy configuration of Extended ACL and the application on an Ethernet interface. The expected result is:
- The interface works properly (because access list is permitting every kind of data traffic in input)
- Checking “show access-list 180”, the counter of matched packets increments for all the packets that are forwarded inside the fa0/0/1.
But actually the Fastethernet 0/0/1 drops all the packets as if all the packets don’t match with access list (And this behavior is really incredible). The interface couldn't be used anymore because any kind of data traffic is denied.
how to perform port security or mac access-list on LAN ports of router 861 or 881.There are commands access-list 700-799 , but I don't know how to apply that access list on configured vlan or particular port.
View 1 Replies View RelatedI want to block access of some clients from the vlan1 to acces internet blocking their MAC address. How can i do this?
I have tring this way:
access-list 700 deny mac address 0000.0000.0000
access-list 700 permit 0000.0000.0000 ffff.ffff.ffff
int fa00
bridge-group 1 {input-address-list 700 output-address-list 700}
but it's not working .
I am having a problem getting this to work and I have always done it with 2 Static ip address. but now this company changed to 1 and I am doing something wrong.
I have comcast with 1 static IP, I have a local LAN with 6 host and 1 server that does Mail and remote access and web traffic.
I need a config that allows me to use 1 static ip on the outside interface of the PIX and allow with an ACL 7 ports open to the server and allow all the local host out to the internet.