Cisco 2901 SPIAD

Similar Questions

• Copy the configuration of Cisco 881 to Cisco 2901

  We replace our router Cisco 881 with a Cisco 2901 router.  If I backup the configuration of the 881 and restore it on the 2901, will there be problems? We just want our 2901 to work the same. Thank you.

  routers/switches etc. can with a base image which may allow only certain features the devices come with these out of the box so that they work.

  You can buy advanced ip services images or images of advanced security that will allow all the features work. For example, you cannot use BGP or ACB unless you have an advanced picture, but you can be allowed to use RIP and EIGRP stub.

  You can check what is running on your 881 with a license to show what it will tell you what is on

• License of dry and Cisco 2901

  Hi guys,.

  CISCO2901-V/K9 can support IPSec VPN Tunnel or should I order SL-29-SEC-K9 in order to create IPSec?

  Guys do you know where I can find the support of the Cisco router boot feature?

  Thank you for helping me!

  Hello Harry,.

  You can check this:

  Software licenses available on the ISR G2

  C2900 router is a powerful platform, but it requires the license of security for VPN support.

  The SSEC-K9 license removes the reduction applied by the US Government on the encrypted tunnel and encrypted flow export restrictions. SSEC-K9 is available only on the Cisco 2921, 2951 Cisco, Cisco 3925, 3945 Cisco, Cisco 3925th and 3945TH Cisco. With the SSEC-K9 license, the ISR G2 router can go above the limit of the reduction of the maximum of 225 tunnels for IP (IPsec) security and the flow rate of 85 Mbps of one-way traffic in or out the ISR G2 router encrypted, with a total of 170 Mbps bidirectional / s.

  Cisco 1941 and 2901 2911 already have maximum encryption within the limits of export capabilities. The HSEC license requires pre-installed image of the universalk9 and license DRY.

  FL-29-HSEC-K9	US Export Restriction Compliance license for 2921/2951	2921 SRI and SRI 2951	SEC - K9 license	Ordered with system license
  FL-29-HSEC-K9 =.	US Export Restriction Compliance license for 2921/2951	2921 SRI and SRI 2951	SEC - K9 license	Paper PAK spare
  L FL-29-HSEC-K9 =	US Export Restriction Compliance license for 2921/2951	2921 SRI and SRI 2951	SEC - K9 license	PAK electronic alternative

  HTH.

  Update: the previous post included the wrong table.

• ALS IP Cisco 2901 and POLITICS with dual gateways LAN-based ROUTING

  Hello

  I am configuring a failover solution combined with the ACB using two bridges already configured. See the attached diagram.

  I currently have two ASA 5505 and a 2901.

  According to the example: http://www.firewall.cx/cisco-technical-knowledgebase/cisco-routers/861-c... I've set up the following in the 2901:

  Interface Port - channel1.1
  encapsulation dot1Q 1 native
  IP 192.168.200.100 255.255.255.0
  intellectual property policy map RM-Comcast-traffic route

  IP route 0.0.0.0 0.0.0.0 192.168.200.200 track 1
  IP route 0.0.0.0 0.0.0.0 192.168.200.150 track 2
  Route IP 10.10.10.1 255.255.255.252 192.168.200.150

  IP extended ACL-Comcast-traffic access list
  object-group permit COMCAST_Routed 192.168.200.0 0.0.0.255 any

  RM-Comcast-traffic route map permit 1
  corresponds to the IP ACL-Comcast-traffic
  set ip next-hop check availability 10.10.10.2 1 excerpt 2

  object-group service COMCAST_Routed
  Eq ftp TCP
  TCP eq www
  TCP eq ftp - data

  ALS IP 1
  ICMP echo - 192.168.200.200
  threshold 2
  timeout of 1000
  frequency 30
  IP SLA annex 1 point of life to always start-time now

  ALS IP 2
  10.10.10.2 ICMP echo
  threshold 2
  timeout of 1000
  frequency 30
  IP SLA annex 2 to always start-time life now

  track 1 accessibility of als 1 ip
  Track 2 accessibility of ALS 2 ip

  I did some tests and the part of failover seems to work but the configuration of the ACB does not work as expected. Only thing missing track 1 each time delivering properly and trak 2 is declining.

  Any help clarifying the feasibility and practicality of this configuration is greatly appreciated.

  Dan

  Adding a value of AD won't fix ACB (sorry if I gave that impression).

  On the client that you are testing with can you look it's the example routing table ' netstat - nr ' example and see what it shows in terms of gateways.

  It can be that you want to debug your routing policy to see what is happening on the router.

  Jon

• Cisco SKU or IDP description

  Hello team Cisco,

  Is there any tool from cisco for me to find a description SKU or PID?

  For example, I need to be able to MySapce for a PID like SL-29-UC-K9 and then a description such as CISCO (SL-29-UC-K9) UNIFIED COMMUNICATION LICENSE for CISCO 2901-2951.

  Have we not these tools?

  Thank you

  CCW would have that information.  Otherwise, Google is your friend.

• VWIC3-1MFT-T1/E1 on Cisco 2811

  Hello community,

  VWIC3- 1MFT-T1/E1 is compatible with router Cisco 2811 (revision 53.51)?

  Currently, I get the following error:

  WIC Slot 0:

  Daughter unknown WAN card

  Module WIC unsupported / disabled this slot machine

  Hardware revision: 1.0

  Number of albums part together: 800-34657-01

  Part number: 73-13419-01

  Review on board: B0

  Deviation number: 0

  Version of fab: 05

  Serial number of PCB: FOC1624628F

  Version identifier: V01

  Product number (FRU): VWIC3-1MFT-T1/E1

  CLEI Code: COUIA7PCAA

  History of the RMA tests: 00

  RMA number: 0-0-0-0

  RMA history: 00

  EEPROM 4 format version

  Table of contents EEPROM (hex):

  0 X 00:04 FF 40 06 00 01 41 46 03 20 00 87 61 01 C0 ED

  0 X 10: 82 49 34 6 B 01 42 42 30 88 00 00 00 00 02 05 C1

  0 X 20: 8B 4F 46 43 31 36 32 34 36 32 38 46 89 56 30 31

  0X20 30: 2D CB 90 56 57 49 43 33 31 4 46 54 54 31 2D

  0X40: 2F 45 31 C6 8 A 43 55 49 41 37 50 43 41 41 03 4F

  0 X 50: 00 81 00 00 00 00 04 00 03 40 C1 CB FF FF FF D9

  0 X 60 : FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF

  0 X 70 : FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF #

  Thank you very much in advance for your quick responses.

  George

  Hi George,.

  Unfortunately not supported on any series 2800

  The Cisco® third generation-1, 2 or 4-channel T1/E1 Multiflex Trunk voice/WAN (MFT VWIC3s) support voice and data applications Interface on the Cisco 1921, 1941 and 1941W (data only) and the Cisco 2901 2911 2921, 2951, 3925, 3945, routers to Services integrated 3925th and 3945TH.

  Table 1. Supported Cisco MFT VWIC3 platforms and Cisco IOS Software Release requirements minimum

  	VWIC3-1MFT-T1/E1	VWIC3-2MFT-T1/E1	VWIC3-1MFT-G703	VWIC3-2MFT-G703	VWIC3-4MFT-T1/E1
  Slot machines Cisco 1900 chassis EHWIC	(1) M3 15.0, 15.1 (1) T1, 15.1 (2) T	(1) M3 15.0, 15.1 (1) T1, 15.1 (2) T	(1) M3 15.0, 15.1 (1) T1, 15.1 (2) T	(1) M3 15.0, 15.1 (1) T1, 15.1 (2) T	N/A *.
  Slot machines Cisco 2900 chassis EHWIC	(1) M3 15.0, 15.1 (1) T1, 15.1 (2) T	(1) M3 15.0, 15.1 (1) T1, 15.1 (2) T	(1) M3 15.0, 15.1 (1) T1, 15.1 (2) T	(1) M3 15.0, 15.1 (1) T1, 15.1 (2) T	15.1 (3) T *.
  Slot machines Cisco 3900 chassis EHWIC	(1) M3 15.0, 15.1 (1) T1, 15.1 (2) T	(1) M3 15.0, 15.1 (1) T1, 15.1 (2) T	(1) M3 15.0, 15.1 (1) T1, 15.1 (2) T	(1) M3 15.0, 15.1 (1) T1, 15.1 (2) T	15.1 (3) T

  * VWIC3-4MFT-T1/E1is supported by Cisco 2911 2921 2951 and, routers Cisco 3900 Series

  http://www.Cisco.com/en/us/prod/collateral/routers/ps5855/data_sheet_c36-609138.html

  See you soon!

  Rob

  "Why don't the best things always go away."

  -The band

• Cisco IOS IPS in router 2921/k9

  Hi all

  I have a router from Cisco 2921 box database (error C2921/K9) series with BAse IP IOS (IOS SL-29-IPB-K9) image. I want to activate the function of IOS IPS level on this router now. Based on the Cisco Document, I found that I need to purchase a license additional subscripton enale the IPS feature. My querry is-

  It will build on the IOS for basic IP base or do I have to change the IOS?

  If I need to buy the Licesne subscription, how can I get the part number and the cost for the same thing?

  Do I need to purchase any additional module for this as (NME-IPS-K9)?

  Thanks in advance for your quick help

  concerning

  Sunny

  Hi Sunny,

  You do not need a module (however you might install a module instead function in IOS IPS).

  You need 2 licenses:

  1 - a 'security' for your 2921 license enable the IPS feature:

  SL-29-SEC-K9

  License security (paper) for Cisco 2901-2951 (the two system & spare)

  (if you don't have a router, but you can order it with the license as a Pack: CISCO2921-SEC/K9)

  2 - a signature subscription license, which is part of a contract of "services to SPI.

  A "services for IPS" is essentially a SmartNet contract (including the replacement of equipment, to the TAC, etc) more access to the update of the signature.

  SKU for that start with CON-SU or CON - SUO and depends on what level of service for the replacement of HW, and if you want a replacement service on the spot.

  for example CON - SU1 - 2921SEC - this includes a SMARTnet agreement with 8x5xNBD without on-site intervention

  For more information:

  http://www.Cisco.com/en/us/prod/collateral/modules/ps10598/ordering_guide_c07_557736_ps10538_Products_Data_Sheet.html#wp9000630

  http://www.Cisco.com/en/us/prod/collateral/iosswrel/ps6537/ps6586/ps6634/product_data_sheet0900aecd803137cf.html

  http://www.Cisco.com/en/us/products/ps6076/serv_group_home.html

  WARNING: I'm not in the sale so you can check with your local sales office or with a partner of Cisco, Cisco. In fact, some partners may offer a signature subscription service that is clean (without cover material).

  HTH

  Herbert

• 2901 router as an SSL VPN using

  Hello world!

  I was wondering if someone could give me a hand on this. I'm trying to use a Cisco 2901 to allow remote workers to access resources on the local network using the Client AnyConnect Secure Mobility Client. I just read this doco

  http://www.Cisco.com/c/en/us/support/docs/routers/3800-series-integrated...

  But it seems it does not support the 2901 platforms. I quote:

  WebVPN or VPN SSL technology relies on these router IOS platforms:

  • 870, 1811, 1841, 2801, 2811, 2821, no. 2851

  • 3725, 3745, 3825, 3845, 7200 and 7301

  Is that all just because this topic is old?

  Before I have to spend money on the wrong license, I decided to give it a go (above the following article). So, when I went to

  ' Configure > Security > VPN > SSL VPN > SSL VPN Manager "CCP says I need license"(securityk9). I then followed the link "activate license" and clicked on the tab 'evaluation licenses. But where there are two that seems good:

  • securityk9 (the CCP one says it needs)
  • SSL_VPN (one who seems reasonable as AnyConnect uses SSL VPN, right?)

  What is the license of right? Anyone can enlighten us please?

  Also, is there any resource that explains better than all the options and how to configure the AnyConnect on a router ISR2, using CLI?

  Thanks in advance

  Alvaro

  Hello Alvaro,

  What IOS version you are using?

  Beginning in Cisco IOS version 15.0 (1) M, the SSL VPN gateway is a licensing feature sits a count on Cisco 880, 890 Cisco, Cisco 1900, Cisco 2900 and 3900 Cisco platforms. A Chair does refers to the maximum number of sessions allowed both.

  For more information, go through:

  http://www.Cisco.com/c/en/us/TD/docs/iOS-XML/iOS/sec_conn_sslvpn/CONFIGU...

  "Please note useful posts.

• FMC with 3 analog lines

  Hello

  I'm new to configuration of the CME, which asks your help for scenario below:

  We have the new branch opening, we have 3 analog lines:

  line 1:4444444

  line 2:5555555

  line 3:6666666

  We have cisco 2901 with CME license and cisco 2960 switch.

  Manager request below:

  line 1 must be used only by him (if any body call out or he wants to call someone)

  line 2 should be used only by the Secretary (if any body call out or he wants to call someone)

  line 3 should be used by all other employees of the branch (12 employees), if any outside body call it addressing the reception who forward your call to a particular person (can also be managing or his Secretary)

  all employees of should share extension (if the manager wants to call an employee or Secretary)

  Director, Secretary or an employee must press button 9 to call outside the lines.

  can you give me some configuration to reach above scenario.

  Thank you

  I think that you can try it and apply correct corlist in the ephone-dn.

  voice pots Dial-peer 937
  corlist manager out
  destination-model 9 t
  port 0/0/0<- analog="" line="" for="">

  voice pots Dial-peer 938
  outgoing Deputy corlist
  destination-model 9 t
  port 0/0/1<- analog="" line="" for="">

  voice pots Dial-peer 939
  corlist out more
  destination-model 9 t
  port 0/0/2<- analog="" line="" for="">

• Transparent IOS IPS

  Implementing Cisco 2901 as a Transparent IOS IPS (like IOS Transparent firewall)-

  Search guides to depth for Transparent IOS IPS configuration - all links to examples of relevant literature worked would be appreciated thanks

  Will use the bridge Group's management CLI or Cisco Configuration Professional (CCP) arrive at the IPS IOS Transparent.

  http://www.Cisco.com/c/en/us/TD/docs/iOS/security/configuration/guide/12...

  http://www.Cisco.com/c/en/us/products/collateral/security/iOS-firewall/p...

• Option not available in Configuration Professional v2 performance routing

  I get a router Cisco 2901 put in place and tries to load balancing/link aggregation and/or failover for my double WAN connections. Being new Cisco's IOS software, I'd rather do my setup using the specialist graphic Configuration interface.  If I understand correctly, the option of routing Performance will help me set up but I don't have this option, available in professional Configuration; any ideas? I downloaded the latest version of CP (version 2) I think; I've been reviewing on the article often referenced on this feature to: Cisco Routing of Performance and reviewed the Cisco Feature Navigator available on http://www.cisco.com/go/cfn for my release IOS; the feature I'm looking for is documented in a flash to http://www.cisco.com/en/US/docs/net_mgmt/cisco_configuration_professional/scrcst/PfR/CCPPFR.swf (screenshot below) presentation:

  

  A summary of key results of the command show version 'IOS' on this router are:

  Cisco IOS software, software C2900 (C2900-UNIVERSALK9-M), Version 15.0 (1) M, VERSION of the SOFTWARE (fc2) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2009 by Cisco Systems, Inc.

  Last update Wed, 30-Sep-09 05:30 by prod_rel_team

  ROM: System Bootstrap, Version 15.0 M1 (1r), VERSION of the SOFTWARE (fc1) BPRouter availability is 5 days, 23 hours, 43 minutes system returned to ROM by system restarted at 11:34:47 PCTime Wed Dec 23 2009 system image file is "flash0:c2900-universalk9-mz.» Spa. 150 - 1.M.bin.

  Cisco CISCO2901/K9 (revision 1.0) with 483328 K/K 40960 bytes of memory.

  Card processor ID FTX134981A3

  2 FastEthernet interfaces

  2 gigabit Ethernet interfaces

  1 module of virtual private network (VPN)

  Configuration of DRAM is wide with parity 64-bit capable.

  255K bytes of non-volatile configuration memory.

  254464K bytes of system CompactFlash ATA 0 (read/write)

  License info:

  License IDU:

  -------------------------------------------------

  Device SN # PID

  -------------------------------------------------

  * 0 FTX134981A3 CISCO2901/K9

  Technology for the Module package license information: "c2900.

  ----------------------------------------------------------------

  Technology-technology-current package Type next reboot technology

  -----------------------------------------------------------------

  IPBase ipbasek9 ipbasek9 Permanent

  Security securityk9 Permanent securityk9 data uc no no no register None None None Configuration is 0 x 2102

  Thank you for your question.  This community is for Cisco Small Business products, and your question is referring to a product Cisco Elite/Classic.  Please post your question in the Cisco NetPro forums located here: https://supportforums.cisco.com/community/netpro?view=overview this forum is subject to the subject matter experts on Cisco Elite/Classic products that may be able to answer your question.

  Kind regards

  Cindy Toy

  Cisco Small Business Support Community Manager

• Conf material Bridge works not

  Hi all

  We have 9.1 CM and added cisco 2901 gateway H323 and configured hardware conf bridge router and it worked a few days ago, our point of arrival and Cisco sx 20 MX 300, registered the CUCM, using 2 SX20 and a MX300, video working fine and sccp Sh connections cmmands calls showed the call details of when endpoints used the Harware conf resrces , but now the problm is when attempting to conference between three enpoints, an audio endpoint only points. and also HS sccp connectiosn command is not shwing none plays, one hears the end points not using equipment for calls vieo cnf is the question

  Please sugest me how to solve this

  I already checked MRG assigned to endpoints and bridge Conf also enrolled in cucm

  Reset it via CUCM, do no sccp/sccp on the router, remove and re-create the profile or review traces CUCM and IPVMS.

• VPN IPSec does not work

  I am trying to set up a VPN between a 2901 router and 831, but I'm not having any success.  When I run crypto isakmp sa, I get this:

  cisco831 #sh crypto isakmp his
  IPv4 Crypto ISAKMP Security Association
  status of DST CBC State conn-id slot
  IPv6 Crypto ISAKMP Security Association

  It doesn't seem to be a sign of life.  I can access internet ok on both routers, but the failure of attempts to ping between the routers LAN IP.  I guess it's a problem of nat or access-list, but I don't know what I'm missing at this time.  Here are my configs:

  CISCO 2901
  version 15.0
  tcp KeepAlive-component snap-in service
  a tcp-KeepAlive-quick service
  horodateurs service debug datetime localtime
  Log service timestamps uptime
  encryption password service
  !
  host name 2901
  !
  boot-start-marker
  boot-end-marker
  !
  no logging rate limit
  no console logging
  Select the secret XXXXXXXXXXXXXXX

  !
  No aaa new-model
  !
  No ipv6 cef
  no ip source route
  IP cef
  !
  IP domain name mondomaine.fr
  inspect CBAC tcp IP name
  inspect the name CBAC icmp IP
  inspect the name CBAC udp IP
  !
  Authenticated MultiLink bundle-name Panel

  secret user name me XXXXXXXXXXXXXXX 5!
  redundancy
  !
  crypto ISAKMP policy 3
  BA 3des
  preshared authentication
  Group 2
  ISAKMP crypto key address 173.x.x.x mypassword
  !
  Crypto ipsec transform-set esp-3des esp-sha-hmac TRANSFORMSET
  !
  MYVPN 10 ipsec-isakmp crypto map
  the value of 173.x.x.13 peer
  game of transformation-TRANSFORMSET
  PFS group2 Set
  match address 199
  !
  interface GigabitEthernet0/0
  Description of the Internet
  IP address 173.x.x.x 255.255.255.248
  NAT outside IP
  IP inspect CBAC out
  IP virtual-reassembly
  automatic duplex
  automatic speed
  card crypto MYVPN
  !
  !
  interface GigabitEthernet0/1
  Description of LAN
  no ip address
  automatic duplex
  automatic speed
  !
  !
  interface GigabitEthernet0/1.1
  encapsulation dot1Q 2
  IP 192.168.1.1 255.255.255.0
  IP access-group 100 to
  penetration of the IP stream
  stream IP output
  IP nat inside
  IP virtual-reassembly
  !
  interface GigabitEthernet0/1.2
  encapsulation dot1Q 3
  IP 192.168.2.1 255.255.255.0
  IP access-group 101 in
  penetration of the IP stream
  IP nat inside
  IP virtual-reassembly
  !
  no ip forward-Protocol nd
  !
  IP http server
  IP http secure server
  IP flow-export GigabitEthernet0/1.1 source
  IP flow-export version 5
  flow IP 192.168.1.5 export destination 9996
  !
  overload of IP nat inside source list NAT interface GigabitEthernet0/0
  IP route 0.0.0.0 0.0.0.0 173.x.x.x
  !
  NAT extended IP access list
  ip permit 192.168.1.0 0.0.0.255 any
  !
  threshold of journal-update of 2147483647 IP access list
  recording of debug trap
  logging 192.168.1.5
  access-list 199 permit ip 192.168.1.0 0.0.0.255 172.20.0.0 0.0.0.255
  !
  control plan
  !
  Line con 0
  line to 0
  line vty 0 4
  exec-timeout 480 0
  password 7 XXXXXXXXXXXXXXX

  local connection
  entry ssh transport
  !
  Scheduler allocate 20000 1000
  end
  ************************************************************************
  CISCO 831
  Version 12.4
  no service button
  horodateurs service debug datetime msec
  Log service timestamps datetime msec
  encryption password service
  !
  hostname cisco831
  !
  boot-start-marker
  boot-end-marker
  !
  activate secret XXXXXXXXXXXXXXX!
  AAA new-model
  !
  !
  AAA authentication login me local
  !
  !
  AAA - the id of the joint session
  !
  !
  !
  !
  No dhcp use connected vrf ip
  DHCP excluded-address IP 172.20.0.1
  !
  IP dhcp pool mypool
  network 172.20.0.0 255.255.255.0
  WR domain name
  Server DNS 8.8.8.8
  router by default - 172.20.0.1
  !
  IP cef
  no ip domain search
  IP domain name mondomaine.fr
  !
  Authenticated MultiLink bundle-name Panel
  secret user name me 5 XXXXXXXXXXXXXXX

  !
  crypto ISAKMP policy 3
  BA 3des
  preshared authentication
  Group 2
  ISAKMP crypto key address 173.x.x.x mypassword
  !
  Crypto ipsec transform-set esp-3des esp-sha-hmac TRANSFORMSET
  !
  MYVPN 10 ipsec-isakmp crypto map
  the value of 173.x.x.x peer
  game of transformation-TRANSFORMSET
  PFS group2 Set
  match address 199
  !
  Archives
  The config log
  hidekeys
  !
  interface Ethernet0
  LAN description
  IP 172.20.0.1 address 255.255.255.0
  IP access-group 100 to
  IP nat inside
  IP virtual-reassembly
  !
  interface Ethernet1
  Description of the internet
  IP address 173.x.x.13 255.255.255.248
  NAT outside IP
  IP virtual-reassembly
  automatic duplex
  card crypto MYVPN
  !
  interface Ethernet2
  no ip address
  Shutdown
  !
  IP forward-Protocol ND
  IP route 0.0.0.0 0.0.0.0 173.x.x.14
  !
  no ip address of the http server
  no ip http secure server
  !
  overload of IP nat inside source list 100 interface Ethernet1

  Crypto-list extended IP access list
  ip licensing 172.20.0.0 0.0.0.255 192.168.1.0 0.0.0.255

  access-list 100 permit ip 172.20.0.0 0.0.0.255 any
  access-list 199 permit ip 172.20.0.0 0.0.0.255 192.168.1.0 0.0.0.255
  !
  control plan
  !
  Line con 0
  password 7 XXXXXXXXXXXXXXX

  no activation of the modem
  line to 0
  line vty 0 4
  privilege level 15
  transport input telnet ssh
  !
  max-task-time 5000 Planner
  end

  A few things that need to be changed:

  CISCO 2901:

  (1) ACL 100 applies to GigabitEthernet0/1.1, however, I do not see 100 ACL configured on the configuration.

  (2) ACL 101 is applied to GigabitEthernet0/1.2, however, I do not see that ACL 101 exists in the configuration.

  (3) NAT ACL must exempt traffic between 2 local networks as follows:

  NAT extended IP access list
  1 refuse ip 192.168.1.0 0.0.0.255 172.20.0.0 0.0.0.255

  CISCO 831:

  (1) ACL 100 is currently applied to the configuration section 2: NAT and Ethernet0. I would create a new ACL for instruction of NAT that should be added to the deny ACL (NAT exemption) as follows:

  access-list 150 deny ip 172.20.0.0 0.0.0.255 192.168.1.0 0.0.0.255

  access-list 150 permit ip 172.20.0.0 0.0.0.255 any

  overload of IP nat inside source list 150 interface Ethernet1

  no nat ip inside the source list 100 interface Ethernet1 overload

  Hope that helps.

• IOS 15

  Hello

  I am replacing a Cisco 2811 running the image c2800nm-advipservicesk9 - mz.124 - 7.bin with a router Cisco 2901 performer c2900-universalk9-mz. Spa. 152 - 4.M4.bin

  In the config of 2811, there are a number of cryptographic controls as shwon below:

  crypto ISAKMP policy 10

  preshared authentication

  Group 2

  !

  crypto ISAKMP policy 20

  BA 3des

  preshared authentication

  Group 2

  ISAKMP crypto secretkey key address 0.0.0.0 0.0.0.0

  invalid-spi-recovery crypto ISAKMP

  !

  !

  Crypto ipsec transform-set esp-3des esp-md5-hmac TF-DMVPN

  transport mode

  !

  Profile of crypto ipsec FRP-DMVPN

  game of transformation-TF-DMVPN

  The crypto isakmp and ipsec crypto commands are not available on the 2901.

  I think it is because the router is not approved for them.

  The feature license see the output is shown below:

  ABZ1-tn1 #show function of licenses

  Name of the function application assessment active subscription RightToUse

  ipbasek9 no no no yes no

  securityk9 Yes No Yes No Yes

  uck9 Yes Yes No Yes Yes

  datak9 Yes No Yes No Yes

  Gatekeeper Yes No Yes No Yes

  SSL_VPN Yes No Yes No Yes

  IPS-updated iOS Yes Yes Yes No Yes

  SNASw Yes No Yes No Yes

  hseck9 no yes no no no

  CME-srst Yes No Yes No Yes

  WAAS_Express Yes No Yes No Yes

  UCVideo Yes No Yes No Yes

  My hypothesis is correct? -If yes what should I do to activate the cryptographic controls?

  Thank you

  Hi James

  Licenses on a 2951 (and other G2s SRI) must be enabled by a license key.

  http://www.Cisco.com/en/us/prod/collateral/modules/ps10598/ordering_guide_c07_557736_ps10537_Products_Data_Sheet.html

  You will need to order the license "security (SEC).

  I hope this helps.

  Barry Hesk
  Intrinsic network solutions

• vs Router Firewall VPN site-to-site

  Dear

  I would like to know the two Cisco 2901 or 2921 router and Cisco ASA 5505 convertible in site-to-site VPN.

  (1) what is the different from building the VPN site-to site between the router and firewall?

  (2) who is the best choice if you are using site-to-site VPN connection?

  Best regards

  Alan.

  With this amount of sites connected to the internet and some in MPLS, you must choose a solution that gives you a good setup - and routing-scalibility. Both is better on IOS then on the SAA. I would go directly to FlexVPN which is the latest technology in IOS and offers many features like good scalability, integration of routing and (if you want) has talked to spoke connectivity without much config extra. Routers need completely new images, I would start with 15.2.4M3.

  For scalability-IPSec you should plan to use certificates, a CA server is provided with IOS:

  http://www.Cisco.com/en/us/Tech/tk583/TK372/technologies_configuration_example09186a0080210cdc.shtml

  --
  Don't stop once you have upgraded your network! Improve the world by lending money to low-income workers:
  http://www.Kiva.org/invitedBy/karsteni