i am having 2 locations & having cisco 1841 & 2821 at both the end connected via a P2P link. Now when i trace location A from location B, the traffic is getting dropped at location A's Vlan HSRP IP address.there is no ACL in that Vlan, but still it is getting dropped.
View 1 RepliesI have a 857w and a 857 router but there doesnt seem to be any HSRP and VLAn support on either router. I have ADVsevcurity on the routers
do Ineed a different IOS or is it just not supported.
It looks like both my HSRP Interfaces (VLAN 600 & 700) cycle through standby --> active ---> speak continuously on one of the two switches. What can be causing this?
*May 4 06:41:24.883: %HSRP-5-STATECHANGE: Vlan700 Grp 0 state Speak -> Standby
*May 4 06:41:33.671: %HSRP-5-STATECHANGE: Vlan700 Grp 0 state Standby -> Active
*May 4 06:41:33.671: %HSRP-5-STATECHANGE: Vlan700 Grp 0 state Active -> Speak
*May 4 06:41:34.251: %HSRP-5-STATECHANGE: Vlan700 Grp 0 state Speak -> Standby
*May 4 06:41:47.691: %HSRP-5-STATECHANGE: Vlan700 Grp 0 state Standby -> Active
*May 4 06:41:47.703: %HSRP-5-STATECHANGE: Vlan700 Grp 0 state Active -> Speak
Below is a basic image of the HSRP and backup link setup for our LAN.
The virtual IP 192.168.178.50 resides on the primary router and fails over to the backup router. Internal default gateways for the switches are set to 178.50.
Switch1 is Layer3 and has two static default routes configured as:
ip route 0.0.0.0 0.0.0.0 192.168.179.50 track 1 - - - (interface line-protocol track)
ip route 0.0.0.0 0.0.0.0 192.168.178.50 2
And the primary router has a static route out 179.50 which tracks the interface (route goes down if interface is down), and a backup static route.
ip route (internal LAN) Gi0/1 track 1 - - - (interface line-protocol track)
ip route (internal LAN) Gi0/2 2
Everything works fine. If the primary router fails, Switch1 tears down the route across Vlan179, HSRP fails over the IP to the backup router and routing continues as normal. If the link across Vlan179 fails, the routers tear down the primary routes and again, things continue as normal.
The problem comes when the primary WAN link fails but the router remains up. This means the default route is still across Vlan179. Normally, Id set an IP SLA on Switch1 to track the WAN link BUT Switch1 only has the BASE IOS and the company wont pay for the Advanced IP IOS so I dont have IP SLA as an option.
How can I get the static default route to failover in the event that only the primary WAN link goes down?
What the different between using hsrp on vlan interface and on physical port (routed port) on Cisco 3750 Switch? Wha the benefits?
View 3 Replies View Relatedi'm going mad on following problem. I'm trying to get 2 networks seeing each other while one of the network is a non VLAN network and the other one is a VLAN network.They should use the same interface so i added VLAN e0/0.122 to the interface e0/0.Send a ping from my asa to both gw-IP's made me happy at first. In second in figured out that i cannot reach any client in the other network. For testing purpose i created an permit acl to any/any for both networks, but the packets still get dropped by the default implicit rule. (deny any/anyMaybe i'm to stupid for this
View 10 Replies View Relatedi have a strange issue with an HSRP Setup. I have two (S1+S2) 3560 as Core/Distribution Layer. Inter-vlan routing are enabled on both Switches. S1 and S2 are connected with an ether channel over four fibre ports. S3 -S5 are the (L2) access layer.
Gi0/1 on S1 and S2 are L3 ports, connect to a Linux Firewall.
HSRP is enabled, S1 is the active router and the STP root bridge.
But, my monitoring via cacti show me, that the Gi0/1 on S2 is active, too! But it should not be active? Only if S1 fails, should S2 the active switch.A client from the access ports on S3 - 5 gets traffic from the Internet via Gi0/1 from S2. Gi0/1 on S1 is active too, but will send mostly traffic to the Internet. Why is S2 active and why route it traffic from the Internet to the client?
We have an MPLS that connects our main office with our 7 branch offices. We have 3Mb coming into the main office and 1.5 into all of the branch offices. I would like to give rdp traffic the highest priority. We have a Cisco 1841 at all branches and a Cisco 2811 at the main office. Do I have to configure QOS on all routers or just the one at the main location?
View 5 Replies View Related im attempting to setup a L2L VPN between an 1841 and an NSA 2400, via the SDM.The Tunnel comes up, and when I test connectivity it shows as being successful, but I do get an error stating:-
"A ping with data size of this VPN interface MTU size and 'Do not Fragment' bit set to the other end VPN device is failing. This may happen if there is a lesser MTU network which drops the 'Do not fragment' packets."
From my reading this shouldnt cause all traffic to drop though, right?
Currently I cannot ping or telnet to services from one end of the tunnel to the other. I was able to ping momentarily from the Sonicwall end at one point, but this disappeared shortly afterwards (without my changing anything regarding the config).
All of the ACLs created were populated through the SDM.
I am trying to roll out a new internet router. The problem I am faced with is the LEC only supports VLAN 1227 and greater, specifically they are assigning me VLAN 2528. I am able to create the sub-interface and setup dot1q encapsulation for VLAN 2528, but the vlan database does not have the ability to add VLAN 2528 to it so I am unable to get layer 2 up and going, thus preventing me from getting the implementation done.
View 11 Replies View RelatedI am about to pull my hair out. I have a 1841 router at one end with 3 ASA's for teleworkers working great. I'm connecting a 4th one that I can not get to work for the life of me. The tunnel is comming up, but its not passing any traffic. I don't see any glaring errors in the VPN debug. The router comes up, reverse route injection does its thing... all looks great. Am I totally overlooking somthing? I must have rebuilt this a dozen times.
: ASA Version 8.2(1) !hostname ciscoasa104domain-name default.domain.invalidnames!interface Vlan1nameif insidesecurity-level 100ip address 192.168.104.1 255.255.255.0!interface Vlan2nameif outsidesecurity-level 0ip address dhcp setroute! interface Ethernet0/0switchport access vlan 2!interface Ethernet0/1!interface Ethernet0/2!interface Ethernet0/3!interface Ethernet0/4!interface Ethernet0/5!interface Ethernet0/6!interface Ethernet0/7!boot system disk0:/asa821-k8.binftp mode passivedns server-group DefaultDNSdomain-name default.domain.invalidsame-security-traffic permit inter-interfacesame-security-traffic permit intra-interfaceobject-group network DM_INLINE_NETWORK_1network-object 192.168.2.0 255.255.255.0network-object 192.168.4.0 255.255.255.0access-list outside_1_cryptomap extended permit ip 192.168.104.0 255.255.255.0
[code]....
We are currently experiencing a problem on an IP SEC VPN tunnel that has all of us here completely stumped. We are hoping that one of you experts out there will be able to assist. Here are some basic details:
NETWORKS
An IPSEC site to site tunnel has been built between the two sites on different networks.
PIX 515E - MAIN SITE
Network 172.16.0.0/24
CISCO 1841 - REMOTE SITE
Network 172.16.99.0/24
ISSUE
All traffic flows over the VPN from the 172.16.99.0 network in the direction of the Pix, such as RDP, SIP etc. Pings will go in both directions across the tunnel. Other than the pings most traffic will NOT flow over the tunnel from the 172.16.0.0 network on the pix to the 172.16.99.0 network on the 1841. It would appear that something on the 1841 is blocking traffic coming in over the tunnel from the 172.16.0.0 network as we can not get a wire shark capture on a PC on the 172.16.99.0 network, other than the ICMP traces. Usually this is an access list problem but we have checked and double checked the configuration and can't see anything.
TROUBLESHOOTING SO FAR
1. Have tried inserting various access list changes to the tunnel on the 1841 to make specific reference to the 172.16.0.0 network.
2. Have tried various NAT entries.
3. Have removed and then recreated the VPN tunnel from a fresh start.
4. Have made the MTU 1400 on the inside interfaces on the Pix and the 1841.
The tunnel is fully up at all times and as we say can ping in both directions.
we've to configure our router 1841 to use both 2 interface Fe for two different vlan (also the second has to go on internet).
Actually we have int Fe0/0 configured with an ip address 192.168.1.1 for lan1 192.168.1.0/24 and we will use the second int Fe0/1 with another ip address like 192.168.2.1 for lan2 192.168.2.0/24.
see below configuration:
[code]...
I have found this workable cisco 1841 config on the NET. From this link: [URL]
But it is doing source NAT from FA0/1 to Fa0/0. If we need to bridge, is it need to use “ip unnumbered”?
See my config below” 1841 config for Unifi, with ip unnumbered“, can work?
1841 config for Unifi, with NAT
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
! !
! Works perfectly on Cisco 1841, IOS v12.4(24)T !
[Code]....
I am trying to config the following setup in the Cisco 1841. Able to ping the IPs of Vlan1(FE0/0/1), Vlan2 (FE0/0/1) and FE0/1 IPs from corresponding networks. But packets are not flowing to other side.
View 3 Replies View RelatedI am in trouble with my cisco 1841 configuration.The "what I want to" schema: very external IP ( AAA.AAA.AAA.AAA ) in the internet cloud => | cisco 1841 external IP BBB.BBB.BBB.BBB | => internal computer IP CCC.CCC.CCC.CCC
View 1 Replies View RelatedI am in trouble with my cisco 1841 configuration. The "what I want to schema":very external IP ( AAA.AAA.AAA.AAA ) in the internet cloud => | cisco 1841 external IP BBB.BBB.BBB.BBB | => internal computer IP CCC.CCC.CCC.CCC
Steps (this what I think should be done):
1. Find all packets from A by acl
2. Route finded packets throught cisco1841 directly to internal ip address
It should be easy but it doesn't.
I run a network that uses MPLS circuits to connect all of the companies different stores. Internet access is through a Cisco ASA5500 here at the corp headquarters.
To make all of this work, we use a little 1721 gateway router to move traffic as needed. All the clients in our corporate office use 10.10.99.1 (Cisco 1721) as a gateway. The 1721 routes the traffic either to the internet (10.10.99.106 Cisco ASA5500) or the MPLS router (159.61.54.30).
For some reason, anything that runs on Linux (Ubuntu server, ReadyNAS boxes, Thecus NAS) will not pass traffic beyond the 1721 gateway router.
I've poured over the config for that router, and I can't find anything that could be causing this not to work. Thinking that the 1721 was bad, I put an 1841 online in it's place, and it did the same thing. I'm a noob when it comes to Cisco configs, but am learning as I go along.
Ive attached a txt file of the 1721 config.
i have router 1841 have 2 interface.i make routing between vlan by subinterface in router and in switch trunk but vlan 5 cannot access internet
View 3 Replies View RelatedI have two 1841's, setting up a Lab WAN in Packet Tracer. I have one of the 1841's run to a DSL modem, then out to the cloud and the same setup on the other end... from the cloud to the DSL modem and to the 1841 on that end... I have all green lights, so that tells me layer 2 is up, but I'm trying to figure out
what IP to assign the routers to test pinging and getting traffic flowing. but the DSL Modem's have the public IP's and dynamically assign an IP to the routers? I've also tried setting up a static IP on the routers fa0/0 interfaces and the pings fail.. Wondering what I am missing to get these two talking.
I have a Cisco ASA 5505 that I have configured. The outside interface is vlan 2 and the inside interface is vlan 1. Port 0 of the ASA is configured to be in vlan 2 and is connected to the ISP provided subnet. Port 1 is connected to my private LAN subnet. I have an additional router connected to Port 2 for guest connectivity. Port 2 is configured to be a member of VLAN 2 so that it can access the ISP provided subnet. From the device connected to port 2 I can ping the vlan 2 interface address of the ASA and from the ASA I can ping the Default gateway of the ISP provided subnet. For some reason the router on port 2 cannot ping the default gateway of the ISP provided subnet. If the vlan were working the same as a vlan in a switch, I would expect to be able to do this. why it is not working or what I can do to get it working?
View 4 Replies View RelatedIs it possible with a 3560 to block all traffic to a certain vlan except for one or two IP addresses? Create an ACL or something? We have a vlan for voice calls (SIP) and we are getting a lot of scnas that are making the phones ring and such, and I think we can stop this if we only allow traffic onto the vlan from the IP's the SIP traffic is SUPPOSED to be coming from.
View 1 Replies View RelatedI have setup a new SFE2000 switch to work in Layer 3 mode using the IP address 192.168.100.254 on VLAN 1.I would like VLAN1, 2, 3 and 4 to be able to communicate with each other while VLAN2 (Guest) needs to be restricted from everything except web access and dhcp assignment from our server.I have been playing with various ACL's in an effort to accomplish this but so far I have drawn a blank in getting this working.
View 3 Replies View RelatedWe have one SGE2000P switch that we are testing in Layer 3. We have a very simple configuration with some vlans that we want to route to our corporate network, but I want to test if there is actually traffic coming out from the up-link port first.
1- Created the vlans:
VLAN1: 10.10.1.12 /16 (native)
VLAN10: 172.16.10.1 /24
[Code].....
Just picked up a ISA550 and have been playing around with it a bit but seem to be having some trouble. I have two LAN subnets in my small business with approx 10 hosts per subnet. I'd like to use the ISA550 to route between them (and to the internet) but can't seem to figure out how. Is it just as simple as creating two VLANS? Can the ISA550 route VLAN traffic?With my old RV042G, I had the option to setup multiple subnets inside the setup menu but I don't see any such area with the 550.
View 2 Replies View RelatedI have a SF300 24 P and Iam trying to configure a voice vlan this is what I have done so far and it doesnt work.
1. create vlan 30 for voice traffic and enable it
2. Telephony OUI add my mac address for allworx phones
3. Port to VLAN add 30 has tagged, port to vlan 1 untagged
4. Vlan to port I try to add 30 and get this error (Port e15 is candidate in voice Vlan 30 and cant be configured as static member in the vlan.
5. Under Discovery LLDP, LLDP MED port Setting Enable MED status, then all other options to yes
In my LLDP neighbor information all my phones are there and says under port ID 0 ( my phones support LLDP and CDP)
Just setup two RV220Ws with a IPsec VPN connection. All working well. However, I have a question regarding how to force ALL traffic from a VLAN to go thru the VPN.IPsec from site A (EU) to site B (USA) working good. On Site A I have a dedicated VLAN that needs to have ALL traffic (internet included) be sent thru the VPN tunnel. The main purpose of this is to have internet presence as if in the USA. This is necessary to access some sites available only in USA specially for the kids -their web sites will not display content because they're not in the USA at the moment. How do I accomplish this? I tried to setup a Static Route for the VLAN but you cannot setup a 0.0.0.0 destination route.
View 2 Replies View RelatedI have two VLANs set up on a Catalyst 2950 switch: VLAN 1 (192.168.1.x) and VLAN 2 (192.168.2.x). VLAN 2 can ping the router on the 192.168.1.x network and nothing else, which is what I want. However, computers on the 192.168.1.x network can ping computers on VLAN 2, which is what I do not want. I want to make it where VLAN 1 and VLAN 2 cannot communicate with one another, but that VLAN 2 can still ping the router on VLAN 1. I've read about access control lists and ip tables
View 3 Replies View Relatedwe have a cissco 4506-e switch with ios version 03.02.05.SG . We ae currently facing a strange problem . Vlan interfaces configured in he switch are not showing input and output traffic, whereas the traffic is seen on the Gig interfaces mapped to the respective vlans . We also tried configuring the load-interval 30 , but there is no change . Interace 3/5 is mapped to vlan 5 . For this issue we have also done the IOS upgrade from 3.1.1SG to 3.2.5SG recently still the issue is same. [code]
View 2 Replies View RelatedI have a L3 core switch with multiple VLANs setup. Is there a way to place an IPS so as to monitor the traffic passing between, lets say, VLANS 1-3 and VLANs 4-10?
View 19 Replies View RelatedI have 2 hosts, 1 plugged in fa 0/21 in VLAN 101 and another in fa 0/22 in VLAN 101 on our L2 Cisco 2960. If I try and transfer files from either host the gig 0/1 trunk port on the 2960 leading tot he 3750 fa 0/1 port hits 100mb (using a real time bandwidth monitor tool), but why? This VLAN is on the same switch, why does it go one way up the trunk to the L3 3750 switch? The L3 3750 is the VTP server and the 2960 is a client. I would of thought the traffic stays local. The 2 hosts don't even have a gateway set.To sum up the typology the 2960 and 3750 are trunked using a single cable. The 3750 hangs of a ASA firewall using SVIs.Here is whatthe traffic looks like when copying a file between hosts (2gb file).
3750 L3 Switch (VTP Server)
interface FastEthernet1/0/4
description Trunk to Cisco 2960 Gig 0/1
switchport trunk encapsulation dot1q
switchport mode trunk
switchport nonegotiate
[code]....
I have a sf300 with (2) vlans (1) ] vlan for data and vlan (100) is my voice vlan I have Vlan (100) tagged traffic, and my VoIP pbx as an access port only to vlan (100) all other ports are trunk ports with vlan (100) tagged and vlan (1) untagged traffic. I get no outbound audio on calls I can call out hear them fine they cant hear me. I am wondering if my tagged traffic leaving the phone is being striped and if so were. I have CDP turned off.
View 1 Replies View RelatedI have a customer, who has the SVI's configured on the Core (4500x) and this is connected to a ASA 5525x, there is a requirement of restricting traffic between different vlans. How can i use the ASA to accomplish this task. ACLs on the Switch are not stateful and hence not considering this option, Also we are not planning to configure the GW's on the ASA since there is lot of traffic between the vlan's and this will become a bottleneck
View 4 Replies View Related