802 1 q tagging with PIX 6.3 (1)

Similar Questions

• 802. 1 x with assignment of VLANs

  Hello

  I'm trying to Setup 802. 1 x with assignment of VLANS. I have been successfully obtained the authentication works, but assigning VLAN is not applied. I tried this on a CE500, and WS2950-12 once encountering the same problem.

  If I "debug dot1x all the" I get a few messages "dot1x-ev: received VLAN Id - 1", if I'm capturing packets on my radius server, I see that the correct attribute pairs are extinguished. "." Nothing in the notes say that 802. 1 x with dynamic VLAN will not work.

  Attribute value pairs

  AVP: l = t = Framed-Protocol (7) 6: PPP (1)

  AVP: l = t = Service-Type (6) 6: Framed-User (2)

  AVP: l = t = Tunnel-Medium-Type (65) 6: Unknown (16777222)

  AVP: l = 5 t = Tunnel-Private-Group-Id (81) Tag = 0 x 01:20

  AVP: l = t = Tunnel-Type (64) 6: Unknown (16777229)

  AVP: l = 6 t = EAP - Message (79) last Segment [1]

  AVP: l = 46 t = Class (25): 53F9068C00000137000102000A011E630000000000000000...

  AVP: l = 14 t = Vendor-Specific (26) v = Microsoft (311)

  AVP: l = 51 t = Vendor-Specific (26) v = Microsoft (311)

  AVP: l = 58 t = Vendor-Specific (26) v = Microsoft (311)

  AVP: l = 58 t = Vendor-Specific (26) v = Microsoft (311)

  AVP: l = 18 t = Message-Authenticator (80): 33B53112C51B15C40BFBDCE687F4C9C4

  Please check if all 3 of these attributes are set correctly on the Radius Server:

  AVP: l = t = Tunnel-Medium-Type (65) 6: Unknown (16777222)

  AVP: l = 5 t = Tunnel-Private-Group-Id (81) Tag = 0 x 01:20

  AVP: l = t = Tunnel-Type (64) 6: Unknown (16777229)

  It seems that only the Tunnel-private-Group-Id is defined, not the other two.

  CFR. http://www.Cisco.com/en/us/Tech/tk722/tk809/technologies_configuration_example09186a008076317c.shtml

• but my tag with a key number has been deleted

  I have a Compaq presario CQ61 laptop but my hard disk is damaged, I bought a new one, try to install vista but my tag with a key number has been cleared. How can I RECOVER my key for vista

  Contact HP/Compaq and order a set of recovery disc for your computer - you can then install with those who, as they should not ask for a key. No one wants a register key your computer came with, except you.

• Problem pairing and using Bluetooth THE TI sensor Tag with Z10

  I can't pair and use THE TI Bluetooth sensor Tag with my Z10 on OS version 10.1.0.273.

  I can find out the sensor with bt_disc_retrieve_devices Tag, but when I try to pair with bt_rdev_pair, I get an "Operation not permitted" error (EPERM). If I skip the step of pairing and just the list of services with a bt_rdev_get_services, I get an error "No such file or directory" (ENOENT). Same thing happens in the settings menu bluetooth where I can see the device, but it fails to the pair.

  And then, when I try to connect directly to a service with bt_gatt_connect_service, I get an error 'No such device' (ENODEV), which leads me to believe that I have to be paired first to connect to a service.

  The sensor Tag I pairs and connects very well with an iPhone 4S and on the flipside, my pairs fine Z10 with other devices THE bluetooth so I don't know which side prevents matching. I was actually at the session of JAM62 to BB Live 2013 and devices we were seemed to pair well with the TI sensor tag. Not sure if the version of the OS has nothing to do with it.

  Anyone else having these issues with the TI sensor Tag matching or know of ways to solve this?

  Updated the Tag TI with TI WHEAT SDK 1.3.2 sensor and now it matches successfully. Thank you!

• Authentication of 802. 1 X with the assignment problem VLAN.

  Hello

  I intend to implement the authentication of 802. 1 X with assignment of VLANS on our network and assign different VLAN on the switch (Cat2960) of access according to the terminals (for example, VLAN10 for VLAN40 for PC, VLA30 for STB IPTV, VLAN20 for voice, WLAN) after a successful authentication.

  Is the topology of the network (backbone L3 Switch: Cat6K) <----->(L2 access switch: Cat2960) <-------->(L2 access switch: Cat2960) <-->WLAN, voice, IPTV, PC. (Please refer to the file for the detailed topology rasthaus)

  I have to respect (switch L2) <-->(switch L2) topology due to wiring problem.

  My question is below.

  1. to take account of different VLAN of terminals, the only way is in trunk on both L2 switches port. is this possible?

  As far as I know, cannot enable 802. 1 X on a trunk port. is it good?

  2. If this is true, is there a solution?

  Thank you for your help. :-)

  You will not run 802. 1 x on the junction between switch ports, but rather on the ports that connect devices to end-users.

• How to activate 802. 1 x with ' Wake on LAN ' EMS 2010 cisco?

  Hello

  We have acquired an EMS cisco 2010 to replace our distribution switch. I've implemented the 802.1 X network. Everything works great except that I can't find how to activate 802. 1 x with "Wake on LAN" on this kind of switch. You have an idea?

  The catalyst, I saw that it was sufficient to activate this control "control-direction authentication {times |}". in}.

  Except that it seems not to exist on this switch. Is there another way to activate 802. 1 x WoL without the help of this command?

  Or how to allow the magic packet (WoL) on a port marked by unauthorized 802.1 x?

  Thanks in advance

  Hervé

  Hi John, it is not supported.

  -Tom

• is compatible with PIX SSM - 4GE manufacturer?

  proposed replacement of PIX - 1FE is SSM - 4GE. This means that it is compatible with PIX?

  http://Cisco.com/en/us/prod/collateral/vpndevc/ps5708/ps5709/ps2030/end_of_life_notice_for_cisco_pix_sec_app_cards_and_hwacc.html

  No it's not. The PIX now being EoS, assume you have / will upgrad to the ASA.

  HTH

• 802. 1 x with the ACS and Windows AD

  Hello

  Im trying to configure 802. 1 x with ACS 5.2 but I am wrong as his very differnet ACS 4.2.

  I installed the ACS for the field and think that I installed the external Idnetity store, however when I try to authenticate a pc using probable authentication "PEAP (EAP-MSCHAPv2), I get a reason for failure 22056 object was not found in the store there is identity.

  Marco

  Hi Marco,.

  I guess you missed a mapping configuration in the Section of access policy.

  Create an Access Service name AS-802. 1 x select user select the Service Type, and select network access. Select the identity of political Structure and authorization. Select PEAP as the authorized Protocol. Click on finish

  You will see the new service click on identity.

  Select the source of the identity you have created, then save.

  Click permission

  Select an access permission by default authorization rule and save.

  Create a Service access rule name 802. 1 x

  Select the Protocol Radius as a Condition and as a compound Condition select RADIUS - IETF:Service - Type match box, then select the service that you created before.

  then you can try again.

  concerning

  Alex

• 802. 1 x with the login script

  Hello

  Before you set the 802. 1 x with ISE. Logon user with a script to map the network drive.

  We deployed the 802. 1 x with ip phone and your PC successfully, but the logon script does not work now.

  Whatever measures are necessary to make the login script work?

  ISE:2.1

  switch: 3750 with 12.2 (55) SE10

  PC:Win7 (to connect to the ip phone)

  IP phone: 6921 (connect to switch f 1/0/4)

  Switch configuration is to see more:

  !
  version 12.2
  no service button
  tcp KeepAlive-component snap-in service
  a tcp-KeepAlive-quick service
  horodateurs service debug datetime localtime show-timezone msec
  Log service timestamps datetime localtime show-timezone msec
  no password encryption service
  Service linenumber
  sequence numbers service
  !
  hostname ISESW01
  !
  boot-start-marker
  boot-end-marker
  !
  enable password 7 xxxxxxxxxxxxxxxxxxxxxx
  !
  username password 7 xxxxxxxxxxxxxxxxxxxx xxxxxxxxxxx
  !
  !
  AAA new-model
  !
  !
  RADIUS AAA server group ISE
  auth-port 1645 10.202.152.91 Server acct-port 1646
  auth-port 1645 10.202.152.92 Server acct-port 1646
  !
  default AAA dot1x ISE authentication group
  AAA authorization network default group ISE
  AAA authorization auth-proxy default group ISE
  accounting AAA periodic update 5
  accounting dot1x default start-stop group AAA ISE
  AAA accounting system by default start-stop group ISE
  !
  !
  AAA server RADIUS Dynamics-author
  customer 10.202.152.91
  customer 10.202.152.92
  !
  AAA - the id of the joint session
  switch 1 supply ws-c3750v2-48ps
  mtu 1500 routing system
  VTP transparent mode
  DHCP excluded-address IP 10.202.21.1 10.202.21.10
  DHCP excluded-address IP 10.202.121.196
  !
  IP dhcp pool testingdhcp
  Network 10.202.19.0 255.255.255.0
  router by default - 10.202.19.1
  10.202.152.21 DNS server
  !
  !
  analysis of IP device
  !
  MLS qos map policed dscp 0 10 18 24 46-8
  MLS qos map cos-dscp 0 8 16 24 32 46 48 56
  MLS qos srr-queue input bandwidth 70 30
  MLS 1 80 90 qos srr-queue input threshold
  priority-queue input bandwidth 2 30 MLS qos srr-queue
  queue threshold 1 MLS qos srr-queue input cos-map 2 3
  queue threshold 1 MLS qos srr-queue input cos-map 3 6 7
  queue threshold 2 MLS qos srr-queue input cos-map 1 4
  queue threshold 1 MLS qos srr-queue input dscp-map 2 24
  queue threshold 1 MLS qos srr-queue input dscp-map 3 48 49 50 51 52 53 54 55
  queue threshold 1 MLS qos srr-queue input dscp-map 3 56 57 58 59 60 61 62 63
  queue threshold 2 MLS qos srr-queue input dscp-map 3 32 33 40 41 42 43 44 45
  -More - mls qos srr-queue input dscp-map 2 3 46 47 threshold queue
  queue threshold cos 1-map of MLS qos srr-queue output 3 4 5
  queue threshold cos 2-map of MLS qos srr-queue output 1 2
  queue threshold 2 cos-MLS qos srr-queue output 2 3 card
  queue threshold cos 2-map of MLS qos srr-queue output 3 6 7
  queue threshold cos 3-map of MLS qos srr-queue output 3 0
  queue threshold 4 cos-MLS qos srr-queue output 3 1 card
  queue threshold 1 dscp-map of MLS qos srr-queue output 3 32 33 40 41 42 43 44 45
  queue threshold 1 dscp-map of MLS qos srr-queue output 3 46 47
  queue threshold 2 dscp-map of MLS qos srr-queue output 1 16 17 18 19 20 21 22 23
  queue threshold 2 dscp-map of MLS qos srr-queue output 1 26 27 28 29 30 31 34 35
  queue threshold 2 dscp-map of MLS qos srr-queue output 1 36 37 38 39
  queue threshold 2 dscp-map of MLS qos srr-queue output 2 24
  queue threshold 2 dscp-map of MLS qos srr-queue output 3 48 49 50 51 52 53 54 55
  queue threshold 2 dscp-map of MLS qos srr-queue output 3 56 57 58 59 60 61 62 63
  queue threshold 3 dscp-map of MLS qos srr-queue output 3 0 1 2 3 4 5 6 7
  queue threshold 4 dscp-map of MLS qos srr-queue output 1 8 9 11 13 15
  queue threshold 4 dscp-map of MLS qos srr-queue output 2 10 12 14
  MLS qos all the output queue 1 1 100 100 50 200 threshold
  MLS qos queue of output 1 all threshold 2 125 125 100 400
  MLS qos queue of output 1 all threshold 3 100 100 100 400
  MLS qos queue of output 1 all 4 60 150 50 200 threshold
  MLS qos all the output queue 1 15 25 40 20 buffers
  MLS qos
  !
  Crypto pki trustpoint TP-self-signed-1210376576
  enrollment selfsigned
  name of the object cn = IOS - Self - signed - certificate - 1210376576
  revocation checking no
  rsakeypair TP-self-signed-1210376576
  !
  !
  TP-self-signed-1210376576 crypto pki certificate chain
  certificate self-signed 01
  xxxxxxxxx
  quit smoking
  Auto qos srnd4
  control-dot1x system-auth
  dot1x critical eapol
  !
  !
  !
  !
  pvst spanning-tree mode
  spanning tree extend id-system
  VLAN spanning tree priority 819 61440
  !
  internal allocation policy of VLAN ascendant
  !
  VLAN 121
  name Voice_Vlan
  !
  VLAN 819
  name 19F_VLAN
  !
  VLAN 888 899
  !
  !
  class-map correspondence AUTOQOS_VOIP_DATA_CLASS
  match ip dscp ef
  class-map correspondence AUTOQOS_DEFAULT_CLASS
  match the name of access by DEFAULT ACL-AUTOQOS group
  class-map correspondence AUTOQOS_VOIP_SIGNAL_CLASS
  match ip dscp cs3
  class-map correspondence AutoQoS-VoIP-RTP-Trust
  match ip dscp ef
  class-map correspondence AutoQoS-VoIP-control-Trust
  match ip dscp cs3 af31
  !
  !
  Policy-map AUTOQOS-SRND4-CISCOPHONE-POLICY
  class AUTOQOS_VOIP_DATA_CLASS
  DSCP ef Set
  128000 8000 exceed-action of the police controlled-dscp-transmit
  class AUTOQOS_VOIP_SIGNAL_CLASS
  DSCP Set cs3
  32000 8000 exceed-action of the police controlled-dscp-transmit
  class AUTOQOS_DEFAULT_CLASS
  Set default dscp
  10000000 8000 exceed-action of the police controlled-dscp-transmit
  Policy-map AutoQoS-Police-CiscoPhone
  class AutoQoS-VoIP-RTP-Trust
  DSCP ef Set
  320000 8000 exceed-action of the police controlled-dscp-transmit
  class AutoQoS-VoIP-control-Trust
  DSCP Set cs3
  32000 8000 exceed-action of the police controlled-dscp-transmit
  !
  !
  !
  !

  interface FastEthernet1/0/4
  switchport access vlan 819
  switchport mode access
  switchport voice vlan 121
  authentication event fail following action method
  action of death event authentication server allow voice
  no response from the authentication event action allow vlan 889
  living action of the server reset the authentication event
  multi-domain of host-mode authentication
  authentication order dot1x mab
  authentication priority dot1x
  Auto control of the port of authentication
  MAB
  added mac-SNMP trap notification change
  deleted mac-SNMP trap notification change
  dot1x EAP authenticator
  dot1x tx-time 10
  spanning tree portfast
  !

  !
  interface Vlan1
  no ip address
  !
  interface Vlan819
  IP 10.202.19.11 255.255.255.0
  !
  default IP gateway - 10.202.19.1
  IP classless
  IP http server
  IP http secure server
  !
  !
  IP access-list extended by DEFAULT ACL-AUTOQOS
  allow an ip
  IP access-list extended redirection
  deny udp any eq bootpc any eq bootps
  deny udp any any eq bootps
  deny udp any any eq field
  deny ip any host 10.202.154.192
  allow an ip
  !
  !
  SNMP - server RO Cisco123 community
  RADIUS attribute 6 sur-pour-login-auth server
  Server RADIUS attribute 8 include-in-access-req
  RADIUS attribute 25-application access server include
  dead-criteria 30 tent 3 times RADIUS server
  RADIUS-server host 10.202.152.91 auth-port 1645 acct-port 1646 borders 7 xxxxxxxxxxxxxxxxxxxxxxxx
  RADIUS-server host 10.202.152.92 auth-port 1645 acct-port 1646 borders 7 xxxxxxxxxxxxxxxxxxxxxxx
  RADIUS vsa server send accounting
  RADIUS vsa server send authentication

  I had a similar problem the workstations where the value "of the computer or user authentication" in the PEAP protocol settings. What is happening is that list DACL that served as of when the computer account has been authenticated restricted just DCs etc, but don't understand the locations required for the login script. It seems that Windows 7 user logon script runs before the dot1x presents the user credentials to the switch.

  Thus, in our case, we have modified the DACL is in place for the computer account to allow access to the locations required for the login script (i.e. the network sharing servers), and everything works.

• How to manage the Tags with PowerCli

  Hello

  I'm trying to find examples how to manage Customs 'Tags' in vSphere 5.1. This new feature is only used in the web client.

  I would like to create, delete, and associate tags with PowerCli objects.

  Is someone can tell me the basic commands?

  Thank you.

  Karl

  
  

  Currently, there are no PowerCLI cmdlets to manage the tags.

  But take a look at Create/Set TAGs via PowerCLI

• How the elements tag with two tags?

  With the following function I can tag with bold and italic tags xml elements. The problem is, I also need '< b > < i >' for example. Now my question is, how is that possible?

  function tagStyles (myXmlElement) {}

  app.findTextPreferences = app.changeTextPreferences = NothingEnum.nothing;

  app.findChangeTextOptions.caseSensitive = false;

  app.findChangeTextOptions.includeFootnotes = app.findChangeGrepOptions.includeFootnotes = false;

  app.findChangeTextOptions.includeHiddenLayers = false;

  app.findChangeTextOptions.includeLockedLayersForFind = false;

  app.findChangeTextOptions.includeLockedStoriesForFind = false;

  app.findChangeTextOptions.includeMasterPages = false;

  app.findChangeTextOptions.wholeWord = false;

  objectToTag = myXmlElement;

  italic conversion

  need to be developed for other styles

  attention to the problems of nested xml tags

  app.findGrepPreferences = app.changeGrepPreferences = NothingEnum.nothing;

  app.findGrepPreferences.findWhat = '. '. + » ;

  app.findGrepPreferences.fontStyle = "italic";

  var myFindTexts = myXmlElement.findGrep ();

  If (myFindTexts.length > 0) {}

  for (var j = 0; j < myFindTexts.length; j ++) {}

  var myText = myFindTexts [j];

  var myStartIndex = myText.characters [0] .index;

  var = myText.characters [-1] .index myEndIndex;

  objectToTag = objectToTag.xmlElements.add ({markupTag: "i", xmlContent:myText});})

  myShift += 2;

  }

  }

  conversion "BOLD"

  need to be developed for other styles

  attention to the problems of nested xml tags

  app.findGrepPreferences = app.changeGrepPreferences = NothingEnum.nothing;

  app.findGrepPreferences.findWhat = '. '. + » ;

  app.findGrepPreferences.fontStyle = "Bold";

  var myFindTexts = myXmlElement.findGrep ();

  If (myFindTexts.length > 0) {}

  for (var j = 0; j < myFindTexts.length; j ++) {}

  var myText = myFindTexts [j];

  var myStartIndex = myText.characters [0] .index;

  var = myText.characters [-1] .index myEndIndex;

  objectToTag = objectToTag.xmlElements.add ({markupTag: "b", xmlContent:myText});})

  }

  }

  bold italics conversion

  need to be developed for other styles

  attention to the problems of nested xml tags

  app.findGrepPreferences = app.changeGrepPreferences = NothingEnum.nothing;

  app.findGrepPreferences.findWhat = '. '. + » ;

  app.findGrepPreferences.fontStyle = "Bold Italic";

  var myFindTexts = myXmlElement.findGrep ();

  If (myFindTexts.length > 0) {}

  for (var j = 0; j < myFindTexts.length; j ++) {}

  var myText = myFindTexts [j];

  var myStartIndex = myText.characters [0] .index;

  var = myText.characters [-1] .index myEndIndex;

  objectToTag = objectToTag.xmlElements.add ({markupTag: "b", xmlContent:myText});})

  }

  objectToTag = myXmlElement;

  for (var j = 0; j < myFindTexts.length; j ++) {}

  var myText = myFindTexts [j];

  var myStartIndex = myText.characters [0] .index;

  var = myText.characters [-1] .index myEndIndex;

  objectToTag = objectToTag.xmlElements.add ({markupTag: "i", xmlContent:myText});})

  }

  }

  }

  When there is an element with the "Bold Italic" style it looks like this: 'my element with < b > < /b > < i > "BOLD" and the italic text < /i > '. There it looks like this: ' my element with < b > < i > bold and italic < /i > < / b > text.

  Does anyone have an idea on this?

  Thanks in advance!

  Dear Stamm,

  Try this...

  objectToTag = objectToTag.xmlElements.add ({markupTag: "b", xmlContent:myText});})

  App.Select (objectToTag.texts);

  App.Selection [0] .associatedXMLElements [0].xmlElements.Add ("i", app.selection [0]);

  Kind regards

  Bala

• Anyone use the &lt; cfdocument &gt; tag with a &lt; cfloop &gt;

  Anyone use the < cfdocument > tag with a < cfloop >

  I'm generating more documents like this.

  < cfloop query = "myquery" >

  < cfdocument type = pdf >

  < html >... .HTML code here... < html >

  < / cfdocument >

  < / cfloop >

  But only the first document is generated in the browser?

  
  

  
  

  My requirement that I want to create multiple PDF and publish to folder and zip folder so that the user can able to download the ZIP file

  
  

  Thanks in advance
  

  My requirement that I want to create multiple PDF and publish to folder and zip folder so that the user can able to download the ZIP file

  (1) create a folder named, say, docsDir, in the current directory.

  (2) create PDF files, using suggestion of Eddie Lotter, name each file dynamically and store them in the folder docsDir.

  Insert here the code to generate the content of #filename # .

  (3) zip file, docsDir, store the resulting file, docsDir.zip, in the current directory.

• Problem with PIX 501-&gt; L2L 1721 VPN

  I am setting up a site to site vpn according to the http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a008051a69a.shtml.

  I want to connect 192.168.105.0/24 and 192.168.106.0/24.

  PIX01 is 192.168.106.1, with dynamic external IP (B.B.B.B)

  RTR01 is 192.168.105.1, with dynamic external IP address (I'm just using DHCP current address of the ISP as A.A.A.A in the config of PIX01 - this is a temporary application, not critical where I can update the address if necessary)

  It seems that the VPN tunnel is established but traffic does not return the router to the pix.  I temporarily hosted all of the traffic on indoor/outdoor PIX interfaces (and icmp).

  If I enable icmp debug I see ping requests from the client to 192.168.106.100 internal interface of the router (192.168.105.1), but no return icmp:

  On PIX01:

  180:-Interior ICMP echo request: 192.168.105.1 ID = 1 length = 40 seq = 298 192.168.106.100
  181:-Interior ICMP echo request: 192.168.105.1 ID = 1 length = 40 seq = 299 192.168.106.100
  182:-Interior ICMP echo request: 192.168.105.1 ID = 1 length = 40 seq = 300 192.168.106.100
  183:-Interior ICMP echo request: 192.168.105.1 ID = 1 seq = length 301 = 40 192.168.106.100

  On RTR01:
  * 03:40:46.885 22 dec: ICMP: echo responded, 192.168.105.1 src, dst 192.168.106.100
  * 03:40:51.713 22 dec: ICMP: echo responded, 192.168.105.1 src, dst 192.168.106.100
  * 03:40:56.713 22 dec: ICMP: echo responded, 192.168.105.1 src, dst 192.168.106.100
  * 03:41:01.709 22 dec: ICMP: echo responded, 192.168.105.1 src, dst 192.168.106.100

  Output of running sh crypto isakmp his:

  PIX01 (config) # sh crypto isakmp his
  Total: 1
  Embryonic: 0
  Src DST in the meantime created State
  A.A.A.A B.B.B.B 0 1 QM_IDLE

  RTR01 #sh crypto isakmp his
  status of DST CBC State conn-id slot
  A.A.A.A B.B.B.B QM_IDLE 1 0 ACTIVE

  Out of HS crypto ipsec his:

  PIX01 (config) # sh crypto ipsec his

  Interface: outside
  Crypto map tag: IPSEC, local addr. B.B.B.B

  local ident (addr, mask, prot, port): (192.168.106.0/255.255.255.0/0/0)
  Remote ident (addr, mask, prot, port): (192.168.105.0/255.255.255.0/0/0)
  current_peer: A.A.A.A:500
  LICENCE, flags is {origin_is_acl},
  #pkts program: 103, #pkts encrypt: collection of #pkts 103, 103
  #pkts decaps: 0, #pkts decrypt: 0, #pkts check 0
  compressed #pkts: 0, unzipped #pkts: 0
  #pkts uncompressed: 0, #pkts compr. has failed: 0, #pkts decompress failed: 0
  #send 12, #recv errors 0

  local crypto endpt. : B.B.B.B, remote Start crypto. : A.A.A.A
  Path mtu 1500, overload ipsec 56, media, mtu 1500
  current outbound SPI: 7cb75998

  SAS of the esp on arrival:
  SPI: 0xb896f6c6 (3096901318)
  transform: esp - esp-md5-hmac.
  running parameters = {Tunnel}
  slot: 0, conn id: 1, crypto card: IPSEC
  calendar of his: service life remaining (k/s) key: (4608000/3151)
  Size IV: 8 bytes
  support for replay detection: Y

  the arrival ah sas:

  SAS of the CFP on arrival:

  outgoing esp sas:
  SPI: 0x7cb75998 (2092390808)
  transform: esp - esp-md5-hmac.
  running parameters = {Tunnel}
  slot: 0, conn id: 2, crypto card: IPSEC
  calendar of his: service life remaining (k/s) key: (4607999/3151)
  Size IV: 8 bytes
  support for replay detection: Y

  outgoing ah sas:

  outgoing CFP sas:

  RTR01 #sh crypto ipsec his

  Interface: Vlan600
  Crypto map tag: IPSEC, local addr A.A.A.A

  protégé of the vrf: (none)
  local ident (addr, mask, prot, port): (192.168.105.0/255.255.255.0/0/0)
  Remote ident (addr, mask, prot, port): (192.168.106.0/255.255.255.0/0/0)
  current_peer B.B.B.B port 500
  LICENCE, flags is {}
  program #pkts: 10, #pkts encrypt: 10, #pkts digest: 10
  decaps #pkts: 10, #pkts decrypt: 10, #pkts check: 10
  compressed #pkts: 0, unzipped #pkts: 0
  #pkts uncompressed: 0, #pkts compr. has failed: 0
  #pkts not unpacked: 0, #pkts decompress failed: 0
  Errors #send 0, #recv 0 errors

  local crypto endpt. : A.A.A.A, remote Start crypto. : B.B.B.B
  Path mtu 1500, mtu 1500 ip, ip mtu BID Vlan600
  current outbound SPI: 0xB896F6C6 (3096901318)

  SAS of the esp on arrival:
  SPI: 0x7CB75998 (2092390808)
  transform: esp - esp-md5-hmac.
  running parameters = {Tunnel}
  Conn ID: 2002, flow_id: SW:2, crypto card: IPSEC
  calendar of his: service life remaining (k/s) key: (4556997/3076)
  Size IV: 8 bytes
  support for replay detection: Y
  Status: ACTIVE

  the arrival ah sas:

  SAS of the CFP on arrival:

  outgoing esp sas:
  SPI: 0xB896F6C6 (3096901318)
  transform: esp - esp-md5-hmac.
  running parameters = {Tunnel}
  Conn ID: 2001, flow_id: SW:1, crypto card: IPSEC
  calendar of his: service life remaining (k/s) key: (4556997/3076)
  Size IV: 8 bytes
  support for replay detection: Y
  Status: ACTIVE

  outgoing ah sas:

  outgoing CFP sas:

  I can provide more information if necessary.

  Thanks in advance for any help,

  CJ

  ISAKMP uses UDP/500 and it is true he helped through phase 1 being upwards (QM_IDLE).

  IPSec uses ESP or UDP/4500, and this is what must be authorized by the FW.

• Safe on Etherchanel / 802.3ad, it works with vmware esx?

  Trunk etherchanel in cisco switch configuration, it works with vmware esx?

  Configuration of the Cisco switch like that (I don't have a switch, can not test it):

  src-dst-ip port-channel load-balance
  the interface vlan 4094
  no ip address
  Interface Port - Channel 1
  switchport
  switchport mode trunk
  switchport trunk encapsulation dot1q
  switchport trunk allowed all the VLANs
  switchport trunk vlan 4094 native
  no ip address
  interface GigabitEthernet1/1
  switchport
  switchport mode trunk
  switchport trunk encapsulation dot1q
  switchport trunk allowed all the VLANs
  switchport trunk vlan 4094 native
  no ip address
  Chanel-Group 1 mode on
  interface GigabitEthernet1/2
  switchport
  switchport mode trunk
  switchport trunk encapsulation dot1q
  switchport trunk allowed all the VLANs
  switchport trunk vlan 4094 native
  no ip address
  Chanel-Group 1 mode on
  end

  What you have should work OK, because it is not too different from the example of work from my lab:

  ocs4948-1 #sh int item in gi1/2nd round

  Building configuration...

  Current configuration: 536 bytes
  !
  interface GigabitEthernet1/2
  switchport trunk encapsulation dot1q
  switchport trunk allowed vlan 2.10
  switchport mode trunk
  MTU 9198
  channel-group 64 mode on
  spanning tree portfast
  spanning tree enable bpduguard
  end

  ocs4948-1 #sh run int item in gi1/6

  Building configuration...

  Current configuration: 536 bytes
  !
  interface GigabitEthernet1/6
  switchport trunk encapsulation dot1q
  switchport trunk allowed vlan 2.10
  switchport mode trunk
  MTU 9198
  channel-group 64 mode on
  spanning tree portfast
  spanning tree enable bpduguard
  end

  ocs4948-1 #sh run int in64

  Building configuration...
  Current configuration: 291 bytes
  !
  Interface Port-channel64
  Description esx402 LACP link
  switchport
  switchport trunk encapsulation dot1q
  switchport trunk allowed vlan 2.10
  switchport mode trunk
  MTU 9198
  load-interval 30
  Storm-control broadcasts 5.00
  spanning tree portfast
  spanning tree enable bpduguard
  end

  ocs4948-1 #sh int trunk

  VLAN Mode Encapsulation native port State
  In64 on 802. 1 q trunking 1

  Port VLAN allowed on trunk
  In64 2.10

  Port VLAN authorized and active in the field of management
  In64 2.10

  VLAN port extending on transmission State and no tree pruned
  In64 2.10

  The only thing to look at will be the VLANs that you got set up on the vSwitch. You have defined VLAN native example, the VLAN untagged on the switch to be 4094, any traffic sent on the aura tags trunk VLAN, which will be removed by the vSwitch.

  In my setup, I have established groups of ports using VLANS and VLAN 2 10. Traffic to the virtual machines on these VLANs are .1Q marked by the physical switch, which is then stripped by the vSwitch.

  Take a look at the section "VLAN in VMware Infrastructure" on page 7 the concepts of virtual networking André already mentioned, but also the other interesting reading material is http://www.vmware.com/pdf/esx3_vlan_wp.pdf.

  Finally, for the side of the switch of things, look at the examples on Scott Lowe's blog at http://blog.scottlowe.org/2006/12/04/esx-server-nic-teaming-and-vlan-trunking/.

  Concerning

• How can I control or change the ID3 tags with the new v12.4 of iTunes?

  On the latest version of iTunes (12.3), right click on a file gave the option "Convert ID3 Tags"... ».

  But with the new iTunes (12.4), this option has disappeared and I can't find a way to control the tag on mp3s.

  Mr Apple, why put obstacles for those working?

  It is still possible, but is no longer a part of the menu of right - or control-click option.  Now, it is available at:

  • File / create new Version...

  Don't know why it was deleted, but Apple say:

  http://www.Apple.com/feedback/itunesapp.html