Cisco :: Where Do Prefix-Lists Fit In
Sep 25, 2012Difference between ACL , Distribution list and route map?
View 5 Replies
ADVERTISEMENT
What Is A Routing Prefix
Dec 13, 2011what is a routing prefix? Does it only get used in one of the layers of OSI?
View 2 Replies View RelatedCisco :: Way To Locate Prefix-list?
Jan 30, 2013Is there an easier way to locate what an ACL, prefix-list, etc is applied to?ometimes its a bit tedious especially on some devices with a lot of config. I would like to see what route-maps a prefix-list is applied to[CODE]
View 9 Replies View RelatedCisco WAN :: QOS On 1841 With Access Lists?
Jan 15, 2013I have new DIA Internet service coming in and unlike the last vendor who provided a router, I am configuring my own. This is my first full Cisco config - I've been looking at this for 3 days now. I have SIP signalling, rtp and default traffic on a (3) t1 multilink (4.5mb). My lan and firewall uses dscp tags and passes them to the 1841 for outbound. The ISP only prioritizes by destination address so I just need the 1841 to respect the tags internally. Inbound, I have only port numbers to go by to differentiate voice traffic and I want to tag EF and CS3 accordingly for use by the 1841 and the rest of my network.
Below is part of my proposed config. I have read tons of Cisco docs and looked at all the queuing methods and this one I understand the best. I am getting the error: "CBWFQ : Can be enabled as an output feature only", so I presume that something is wrong on an input definition somewhere. For now all the firewall functions are done at the actual firewall (Sonicwall NSA) so other than limiting ports to the PBX everything else is just pass-through. Any changes required. IOS is 12.4(4)T1.
[Code]....
Cisco :: Difference Between Prefix And Distribute List?
Oct 23, 2011Difference between prefix-list and distribute list?
View 6 Replies View RelatedCisco WAN :: 3750 - QoS With Access Lists Not Working
May 17, 2011i have a stack of 3750 (WS-C3750G-24TS-1U with IOS 12.2(53)SE2).
This is the conf I have:
!
class-map match-all DC_SC-to-DC_UW
match access-group 100
[Code].....
Cisco Firewall :: ASA 5520 - Sub-interfaces With IPv6 Prefix
May 31, 2011We have been testing out IPv6 configurations on a 5520 running 8.2(4). We have assigned EUI-64 prefix addresses to sub-interfaces to allow clients to auto-configure there IPv6 IPs and it works correctly. I used ASDM to do the original configuration and noticed that there were two different ways to do it, both of which seem to work. I can add a prefix under the Interface IPv6 Addresses dialog box and check EUI64 or I can add it under the Interface IPv6 Prefixes. But using the two methods yields two different interface configurations:
1.
interface GigabitEthernet0/1.40
vlan 40
nameif test
[Code].....
Cisco AAA/Identity/Nac :: ACS 5.2 Multiple Domain Prefix Searching?
May 23, 2011We have an ACS 5.2 server connected to an AD domain controller which has several trusted domains. (domain1, domain2, domain3) We currently have to specify which domain each user belongs to (ie, domain1user) in order to connect. We would like to only have to enter the user name without the prefix, (ie, user1) and have ACS automatically check each domain for a match. Is this possible with ACS 5.2? I seem to remember this was possible with ACS 4.2.
View 2 Replies View RelatedCisco WAN :: Big Prefix Block Separation To Different Public AS 65200
Jan 7, 2013Imagine AS65200 anouncing block 10.10.0.0/22 to the internet.Now for some reason we need to announce block 10.10.2.0/24 from AS65333.How should routes from AS65200 be announced now?
Can I maintain the whole /22 block since 10.10.2.0/24 from AS65333 is more specific? Or should I now break AS65200 announcement into smaller prefixes completelly excluding .2.0/24 ?( .0.0/23 and .3.0/24)
Cisco AAA/Identity/Nac :: ACS 5.3 Stripping Radius User Prefix
Mar 7, 2012I have configure my ACS 5.3 to strip the prefix of the radius username (Domain week wang) it received and I also configured my ACS as the External Radius Server. However, this does not seem to work. The authentication protocol that I am using is PEAP Mschap v2.
I have read inside this forum that due to the fact that the radius username and password is transited inside the TLS tunnel of the PEAP MsChap v2 thus ACS is not able to do the stripping as it is not allow to touch anything inside the TLS tunnel.
Cisco Routers :: RV220W And IPv6 Prefix Delegation
Aug 6, 2012I noticed that the recently released firmware version 1.2.0.9 for the RV110W router mentions in the release notes that DHCPv6 Prefix Delegation is now supported.
Does that mean that this feature will also be implemented in some future firmware release (if we ever see one) for the RV220W router? This is the method used by most if not all ISPs around the world (e.g. Comcast) for IPv6 and the only one RV220W does not currently support. P.S. As of beta version 1.0.4.13 there is no support for IPv6 Prefix Delegation.
Routers / Switches :: BGP Prefix List Is Not Updated?
Nov 22, 2012BGP prefix list is not updated when other party having new downstream with different AS number.BGP filter has disabled but the prefix list is still not updated.BGP soft reset is performed, but the prefix list is still not updated.BGP prefix list is only updated when the other party having new prefix with the same AS number.Can explain why?
View 1 Replies View RelatedCisco :: Access Control Lists And A Bridge Group?
May 13, 2012I've got a Cisco 1841 with 2 FastEthernet ports here. My Cisco isn't great, and I've been given a problem I don't seem to be able to crack.Essentially, I have one network with two sides. I've connected these to fe0/0 and fe0/1 on the router, and put them interfaces into a bridge group which as far as I can tell, essentially makes the router a 2 port switch...I know this won't make a lot of sense from a normal network point of view, but what we need to do is allow all traffic from fe0/0 to fe0/1, but not allow any traffic in the reverse direction. The traffic allowed to flow from fe0/0 to fe0/1 must include broadcast traffic (infact that is the most important traffic, its how the silly theatre application works). None of the traffic is IP addressed.... ie, each of the devices on the network assign themselves an IP address, and then throw broadcast traffic out on to the "dedicated physical network" that exists between them for communication[CODE]
View 2 Replies View RelatedCisco Firewall :: ASA 5510 8.2(1) Using Hostnames In Access-lists?
Jul 12, 2012I need to allow a specifc hostname through my firewall. I found this article: [URL] But it's only for 8.4 updated ASA's and above.
Doing more research, I found this article: [URL] And have been trying to reverse engineer it. Am I on the right track?
Cisco Wireless :: WRVS4400N - Get IPv6 Prefix From WAN Side Of Router?
Oct 9, 2012Since this router already set up for IPv6 and Dual-Stack traffic, would it be possible to give it the ability to get its IPv6 prefix from the WAN side of the router.
Example:
I have Comcast, and as long as my modem and router support IPv6, with the router also supporting DHCPv6-PD to get the /64 prefix from comcast.
I now have an RV180W so this is not an issue for me, but my father is inheriting the WRVS4400N from me and he is also on Comcast.
Cisco Firewall ::ASA 5550 - ADSM Created Access Lists
May 9, 2012I am trying to unravel a ASA 5550 config that has been created over several years, by multiple people, some who used ADSM, some who used CLI.
None of them ever removed any lines from the configuration, and none did any documentation. When examining the actual configuration from a CLI perspective:
1. Does an ADSM- created access list end with any specific ADSM- added suffix?
2. When ANY access list is created in an ASA 5550, does it HAVE to be included in the access-group command to be functional? Can it also be functional if referenced in a "nat" command?
3. If the access list does meet either of the criteria specified in question #2, is it completely non-functional?
4. If an access list is applied to a logical or physical port that is shut down, is the access list functional?
Cisco Firewall :: PIX515 - Timeout ICMP / Access Lists?
Mar 29, 2011I am using a Pix 515 with IOS 8.0(3).I have in my access list on the outside interface.......access-list outside_access_in extended permit icmp any 12.23.34.0 255.255.255.0 echo access-list outside_access_in extended permit icmp any 12.23.34.0 255.255.255.0 echo-reply.......in order to allow ping requests and ping replies into my inside network. This certainly works since I can ping the inside from outside and vice versa, but in the ASDM display of access rules, the hit count for these two lines is always zero. If I run 'show access-list', the hit count for these lines is non-zero.
Why doesn't the hit count show up in the ASDM gui display?Also, I have read that the PIX does not treat ICMP in the same way as TCP or UDP and there is no stateful behaviour towards ICMP. However, if I set up a continuous ping from outside to inside and then disable the above access list rule allowing echo requests towards the inside, the ping continues whereas I would expect it to stop.
In the config there is 'timeout icmp 00:00:02' if there is no stateful connection for ICMP, why is there a timeout value for it?
Cisco :: LMS 4.1 Device Change Audit Lists Wrong Users?
Aug 14, 2011I have noticed that under the Device Change Audit list under the configuration dashboard. LMS lists the wrong user for the last change. For example. User ABC performed a change on a switch yesterday but switch shows user XYZ has performed the change.
e.g.
SwitchA
! Last configuration change at 16:27:06 AEST Mon Aug 15 2011 by ABC
User XYZ then performs changes on switchB, switchC. These show up correctly. but the change on switchA shows user XYZ instead of ABC.
User XYZ has never logged into the switchA in question.
Cisco WAN :: 1941W / IPv6 - Cannot Enable DHCP Client Prefix Delegation
Feb 3, 2011I am struggling turning on DHCP client prefix delegation on a dial 0 interface on at 1941w.
Everything can be configured apart from prefix delegation features. The following command is just are missing.
int dial 0
ipv6 dhcp client pb
I have configured this on a 877 router with no problems. I have tried 15.0(1)M3 and 15.1(3)T.
Cisco Switching/Routing :: Object-groups In Access-lists On 3750X?
May 29, 2013I have started to use ip extended access-lists on several 3750X-switches to filter inbound and outbond traffic on the VLANs. But it seems that the use of object-groups is not supported, is this correct? Is it really no way to group different ip-addresses into groups and then use these groups in the access-lists?
I am running sw version 15.0(1)SE2.
Cisco Firewall :: Automatic Naming / Binding Of Access Lists With ASA 5550?
May 8, 2012I have been told that if an access list is created with the suffix _access_in, that if the preifx is the name of an interface, then that access list is automatically bound to that interface, even if there is no explicit command doing that. I looking at the config of an ASA 5550.
example:
Interface is Production
access list is called Production_access_in.
Is that access list automatically bound to the Production interface, even though it does not show up in any other commands?
Cisco Firewall :: ASA5505 8.4(4)1 Access-Lists Created In CLI Do Not Show In ASDM
Apr 30, 2013Yesterday, I configured ASA via CLI for Static PAT and created some entries in an access-list. I will be testing that setup this evening.
However on a quick double check of the settings on the device via ASDM I could not see the acess-list settings. I searched every tab and found nothing so I PuTTYed into the device and checked the running config. The rules I created were right there. Is this something I should expect? If so doesn't it defeat the point of having a GUI if it does not show a complete running config?
Cisco Routers :: RV220W - DHCPv6 Prefix Delegation - Editing Configuration File?
Jan 25, 2012I am trying to configure this router to obtain an IPv6 address from my ISP who offers a dual stack IPv4/IPv6 DHCPv6 Prefix Delegation service.
I did a WAN packet capture to see the type of DHCPv6 packets the router sends to the ISP in order to obtain an IPv6 address and I saw that the router is sending DHCPv6 solicitation packets of type IA_NA i.e. for Identity Association for Non-temporary Address. However, most ISPs that offer a dual stack IP4/IPv6 service, they use DHCPv6 Prefix Delegation in which case the router is expected to send DHCPv6 solicitation packets of type IA_PD i.e. for Identity Association for Prefix Delegation.
I then downloaded its configuration file and saw the following:
dhcpv6c = {}
dhcpv6c[1] = {}
dhcpv6c[1]["renewTime"] = "3600"
[Code].....
So, the option for the DHCPv6 client to perform a prefixDelegation request is disabled. Does that mean that if I set this flag to "1" it is going to work? Well, I edited the configuration file and changed this flag but the router refuses to load it! It complains about the file being changed. How does it know that? Is it computing some type of checksum? How can I manually edit this flag and update the router's configuration?
Access Control Lists Deny Traffic From Entering Network
Oct 5, 2011My network topology consists of 3 directly connected routers where the central router contains sensitive data and i need to block traffic from ENTERING the LAN adjoined to that router. My issue is creating an access list to DENY traffic from entering the network connected to Fa0/1 but ALLOW traffic to exit from that network. I am using one class C network which is subnetted 7 times to provide me with the required LAN's.
View 2 Replies View RelatedLinksys Wireless Router :: EA4500 Prefix Delegation For Establishing An IPv6 Connection
Aug 30, 2012My ISP (OTEnet, Greece) offers IPv6 connectivity in the form of dual-stack IPv4/IPv6 with the requirement that the router supports DHCPv6 Prefix Delegation for establishing an IPv6 connection.Using other routers (Cisco 887W, DrayTek Vigor2130n), I have established an IPv4/IPv6 connection but I am unable to do so with the EA4500. As a matter of fact, when I have the "IPv6 - Automatic" option enabled the router not only cannot obtain an IPv6 prefix from the ISP but it gets stuck in the connection attempt and never obtains an IPv4 or an IPv6 address. I have to disable the IPv6 option in order to simply establish an IPv4-only connection without problems.So, my questions are:
1. Does the latest (2.1.38.38880) firmware support dual-stack IPv6 and DHCPv6 Prefix Delegation?
2. If the router cannot negotiate an IPv6 connection why is it not establishing an IPv4 connection only but gets stuck in the process?
Cisco Switching/Routing :: Outbound Versus Inbound Access Lists On Catalyst 3750X?
Mar 17, 2013I want to configure accesslists on my Catalyst 3750X-switches to protect different VLANs/networks. Any best-practices about inbound versus outbound accesslists? In my head it is more readable and easier to understand the config when accesslists are assigned outbound on the VLAN to protect instead of assigning them inbound on all possible source-VLANs. But of course, from a performance point-of-view it is better to use inbound access-lists to avoid un-necessary routing etc.
View 1 Replies View RelatedCisco Switching/Routing :: 800 / Use ASA To Configure All The Vlans And Intervlan Routing And Access Lists?
Jul 4, 2012upgrading our small office network. We currently have about 75 employees with probably 125 devices on the network. I'd like to create about 10 vlans for the different departments and then configure intervlan routing as needed. Currently we have all unmanaged switches and it's just a huge broadcast storm on the network. We are upgrading our Cisco 800 router to an ASA5505 sec. Plus license. I need some recommendations on switches. Of course, this needs to be done as cheap as possible.... Is there a way to use the ASA to configure all the vlans and intervlan routing and access lists and use a cheaper switch to provide the access layer to hosts?
View 4 Replies View RelatedCisco WAN :: 2621 / Time-Based Access Lists Using Time Ranges?
Jan 4, 2011I have one 2621 router i want to creat time base access list so that one of my subnet user(10.128.194.0 255.255.255.128) use only internet between 11am to 2pm.
View 15 Replies View RelatedCisco :: Test Fast Roaming Using A Cisco 2100 Series Controller And 2 1140 APs?
Jul 20, 2011I'm trying to test fast roaming using a Cisco 2100 Series controller and 2 1140 APs. The initial authentication succeeds fine and the wireless connection works ok using WPA2+CCKM and LEAP with a Cisco ACS radius server.The problem is that the client does not attempt to preauthenticate with the other AP because the RSN Capabilities IE in the AP beacons and probe responses do not set the RSN Preauthentication capable bit. I can't figure out what it takes to get the APs to indicate to clients that it can do preauthentication. I'm been crawling through all the documentation I can find, to no avail.
View 1 Replies View RelatedCisco WAN :: Does Cisco Catalyst 2960-8TC Support Bandwidth Limit Control
Aug 22, 2011We are about to share a 10 MBit ISP connection with 2 others companies, and they are going to split the bill up into 3,3 and 4 Mbit, so we where thinking that we could setup a switch before their and ours router and provide them with a static IP from our ISP. But is it possible to set a bandwidth limit on the ports of a Cisco Catalyst 2960-8TC, so that we can set a limit of 3,3 and 4 on 3 ports.
View 1 Replies View RelatedCisco Wireless :: WLAN Cisco / AP 3502e - How To Get PAT (Product Acceptance Test)
Dec 3, 2011I want to PAT my project of WLAN and i attached the document, how I create the Testing Criteria of the said scenarios, PAT document includes WCS 7.0, WLC 5508, MSE 3310, Cisco AP 3502e and ACS 4.2.
View 0 Replies View RelatedCisco Firewall :: Cisco ASA5510 Unable To Block Unwanted URLs
Jul 12, 2012I have cisco ASA5510 firewall using in my network but unable to bolck Url's unwanted. can i block the [URL] on the asa by using regular exp.
View 3 Replies View RelatedCisco Switching/Routing :: Configuring COS On 2960G Switches With Non-Cisco Phones
Mar 1, 2012I have 7 POE switches that have ESI IP phones attached. I have two VLANS, 1 and 2. VLAN 2 is used for voice and is defined in each switch.The ESI IP phones connect to my POE switch ports and the pc attaches through the ESI IP phone.
I have had voice quality issue between floors in my building. Talking to others on my floor via the IP phone, there are no voice quality issues. [code]