First hop redundancy protocols & IP SLA

Similar Questions

• FabricPath or OTV between two data center using Direct fiber cable

  Hello

  I have two data center both of them has the same equipment N7k, N5k and N2k, and we want the dataCenter being active/active, I'm really confused to use OTV or FabricPath characteristic, if someone can help me with my scenario and explain to me what is the best solution and advantage and disadvantage between OTV and PabrcPath.

  Many thanks in advance

  Hi Steven,

  No problem, I'll go through your points as completely as possible. I advise you to read more about these protocols, maybe if you have access to INE or similar, see their videos on this. I would also like to say again that I have not seen all documentation Cisco indicating that FabricPath to be used as a DCI.

  With regard to the way fabric you ask what follows...

   1. only can use it between two datacenters of you have more we can't, please correct me?

  No, you can use the path of fabric with more than two data centers, but even with OTV, you can use it with more than two data centers.

   2. HSRP localization can not be implemented as OTV. However You can have two differnet Gateways at the Data Center 1 and 2 using two different HSRP groups. If server is moved dynamically from, (i didn't understand this point can you please explain with example?

  OK, so this is a GREAT topic. Location of HSRP CAN be implemented with OTV, but cannot be implemented with fabric path. First hop redundancy protocols can be localized and is supported by Cisco with OTV, this basically allows the same default gateway to reside in two of your data centers providing the ACTIVE/ACTIVE configuration. So no matter where your VM is, they did not change their default, even if gateway your servers to move to the other datacenter.

  If we didn't have this, we would have only an active member of HSRP divided between DC and things would be extremely troublesome in regard to traffic flows. A virtual machine in DC2 VLAN needs to talk to host in VLAN B. But the default gateway is completely in DC1. So frame is sent to the ICD in DC1, then the gateway by default, routes packets VLAN B. This VLAN B lies in fact in DC2, so now it has to go all the way back to DC2. You get my point...? :)

  With localization happen only local to the domain controller. If all servers / VMS in the domain controller can speak locally to its "own" default gateway.

   3. unknown unicast flooding (can you give me an example?)

  Unknown unicast traffic is unicast packets/images with unknown destination mac address. By default, switches are flooding this type of traffic to all ports in the VLAN. With path of fabric that would take place during your DCI, but with OTV, it is all taken care locally, so massive savings on bandwidth here and it is much more effective.

   4. ARP optimization between Data Center (can you give an example regarding ARP optimization?)

  There is another function of OTV, which makes it far superior on the way of tissue. Essentially, we are reducing the volume of traffic passing through the transport infrastructure (i.e. ICD)

  When ARP, host in DC1 to host that responds in DC2, we use links and there is travel time of package that might be minimal, but is not the most optimal. OTV AED - or edge device spy ARP response and subsequently knows that this mapping exists from there. ARP takes place after the first Protocol, the EDA almost proxy ARP to DC1 so the ARP request locally does not have to travel to DC2.

   5. Typically two flows (Odd VLANs by OTV-VDC-1 and even vlans by OTV-VDC-2) carry the entire layer 2 traffic flow between the two Data Centes. Hence the load balancing the links is not efficient. ( (can you explain compare with FabricPath if you have example?)

  IMHO, it's bad and good. Balance the workload of the OTV if you have more than an AED on site. VLAN strange appointment via an AED, even numbered VLAN go through the other. Depending on traffic on VLANs, this could become unbalanced. Fabric used by all its links to mac addresses 'route' to the respective SID - ID switch she needs to do. So perhaps a better uniformity of split here.

   6. VLAN scalability for OTV is lower than FabricPath as of this content writing. (can you explain what this mean i didn't understand it)

  I completely disagree with this comment. I too do not understand.

   7. Resiliency of FabricPath network is better than OTV in some failure scenarios.(can me an example ?)

  I also disagree with that. Resilience of path of fabric could be same as OTV or perhaps better. However, my personal experience is that OTV fine tuning with things like BFD failover is much faster!

  Fabric is good because the control of aircraft ISIS and its operation is admirable, but could say the same for the OTV.

  Lets say one of the DCI links had to die, the transmission of the tissue path would continue through the other links, then perhaps for low latency, high frequency, environments that would be beneficial. OTV will change the EDA and re - learn mac, announced by other AEDS, addresses, but as I said, the time could be extremely minimal and tuning. This isn't a big deal, unless you need under second time convergence!

  I hope that I have answered your questions, I recommend use for your DCI OTV, use the path of fabric for your inside of local switching in your DC. This has been implemented repeatedly and the links I sent you the models validated Cisco also point out.

  Remember - fabric has been built to be a step towards TRILL, and replacement of protocols spanning-tree, OTV was built especially for the dci. They are both built and examples of specific design. It makes no sense to get these confused or mixed up, unless there is a real and pressing the case.

  Joel conclusion is right, use the right tools for the job. If the use case is good for the FP then OK, if not, OTV.

  Rcmnd - reading http://www.packetmischief.ca/2013/04/23/DCI-series-overlay-transport-vir...

  These are just my thoughts.

  Bilal (CCIE #45032)

• Question of vPC NEXUS7K

  Guyz please correct me if im wrong, I have 2 x Nexus7k and lets say 1 3750 switch now I need to have the connected and active also vPC inter - vlan routing for VLAN10 on the two Nexus switches as follows: -.

  SW1 - 2x10G - SW2 Nexus nexus

  (Gi0/3)-/(Gi0/2)

  3750 Switch3

  |

  VLAN 10

  Requirements on the Nexus two, SWs

  ------------------------------------------------------------

  (1) turn on vPC on both switches to Nexus

  (2) create vPC area 8 on the two switches

  management interface 3) the use of two switches to configure the peer of vPC keepalive

  (4) (4) configurer set up on links two 10 G on both sides on the port channel 5, turn on the trunk and spanning tree-type network

  (5) activate vPC Peer to the port-channel 5 on both sides

  (6) create VLAN 10 on Nexus SW1< by="" doing="" this="" shouldnt="" vlan="" 10="" be="" created="" on="" nexus="" sw2="" by="" default="">

  (7) create the Vlan 10 interface and IP address assignment< is="" there="" anything="" i="" need="" to="" add="" here="" other="" than="" this="" also="" the="" interface="" vlan="" will="" be="" added="" automatically="" on="" the="" other="" switch="" with="" the="" same="" ip="" address="">

  (8) create port channel 7, assign Gi0/3 and Gi0/2 and allow both the trunk

  (9) select vPC 101 to the channel port 7 on both sides

  Requirements on the two 3750 SW1

  ------------------------------------------------------------

  (1) create a vlan 10

  (2) assign the interface vlan Access 10

  (3) to activate the trunk Gi0/3 and Gi0/2

  (4) create port channel 7 and add the two links

  -NOW assume that everything is configured correctly, all links between the switches that none should be blocked by STP and VLAN 10 traffic should be secured by two Nexus switches?

  Hello

  Most of the steps you outlined is correct, although a few comments:

  (3) use the two switches management interface to configure the peer of vPC keepalive

  A point to note here is that if you have a supervisor engine double (SE) in your Nexus 7 K, then you need to install the management between the two interface IS active that is current and wait for SE, since the two N7K to the same local network. This way you will always have peer connectivity vPC regardless of who is active.

  (6) create VLAN 10 on Nexus SW1< by="" doing="" this="" shouldnt="" vlan="" 10="" be="" created="" on="" nexus="" sw2="" by="" default="">

  VLANs are not created on the second switch unless you use the switch profiles i.e., config-sync, and this feature is not supported on the Nexus 7 K.

  (7) create the Vlan 10 interface and IP address assignment< is="" there="" anything="" i="" need="" to="" add="" here="" other="" than="" this="" also="" the="" interface="" vlan="" will="" be="" added="" automatically="" on="" the="" other="" switch="" with="" the="" same="" ip="" address="">

  I guess the obvious thing is to allow a first Hop Router Protocol as HSRP. Note that when you use HSRP jointly with vPC, while the control plan continues to operate as active / standby, in a perspective of data plan, both routers are capable of transmitting data in VLAN that is, assets.

  With regard to the SVI created automatically, according to the note to point 6 above, the IVR will not be created as there is not of the Sync feature of config on the Nexus 7 K.

  -NOW assume that everything is configured correctly, all links between the switches that none should be blocked by STP and VLAN 10 traffic should be secured by two Nexus switches?

  Fix. You should probably also follow best practices spanning tree as Setup providing the bridge root is located on one of the Nexus 7 K, the root of the backup is the second Nexus 7 K etc.

  This and much more are covered in the Configuration and Design Guide: best practices for Virtual Port channels (vPC) on switches Cisco Nexus 7000 Series on CCO. It is a very good reference and well worth taking a look through.

  Concerning

• Question of investment and JOINT redundancy

  Hi, the JOINT-2 supports any kind of redundancy Protocol?

  I can't see anything in the configuration guide.

  If I wanted to place a redundant pair outside a pair of firewalls, how I managed the redundancy of them.

  My other question is, is it better to place the METHOD outside the firewall external face or inside?

  Thank you, Dom

  Please see the attachment for a few design guidelines.

  Concerning

  Farrukh

• From single to multiple IP addresses external IP traffic internal

  We are transitioning to a Symantec SMS to a Cisco ASA 5505, and I'm running into a lot of trouble to replicate our configuration for inbound traffic. We currently have a Setup something like this:

  (Of course I pick up a bunch of arbitrary numbers here.)

  1.2.3.4 port one--> 10.1.0.1 port one

  1.2.3.4 port b--> 10.1.0.5 port b

  1.2.3.4 port x--> 10.1.0.20 port p

  1.2.3.4 port is--> 10.1.0.21 p port

  1.2.3.4 port z--> 10.1.0.22 p port

  1.2.3.4 is the unique external IP address we use for traffic that passes through, and 10.1.0.x internal host. x, y and z are ports chosen arbitrarily in a sequence.

  I'm doing it via the ASDM. The ASA is running 9.1 2 software and I use ASDM 7.1 (3). I'm trying to accomplish this by using Configuration > firewall > public servers.

  What I do is the following:

  1. In Configuration > firewall > objects > network objects/groups, create objects for the external IP address and all internal hosts.
  2. In Configuration > firewall > objects > objects/Service groups, create objects TCP ports x y z, and a TCP object for p port (which is not in the default set). Protocols on ports a and b are in the game by default, so they do not need to be defined.
  3. In Configuration > firewall > public servers, add a series of entries of public server with the external host as public IP, address the external interface as the public Interface, the internal as the private Interface interface, the host in question as IP address private, and in the case the two first entries, the protocol chosen as the private service sector. In the case of the last of three entries, I also selects "public address specify if it is different from the private Service. This will allow the static PAT. "I then selects the associated service from port p as the private Service and the service associated with the ports x, y or z (respectively) in the public service.

  .. .or at least, that's what I'm trying to do. I have encountered the following problems:

  1. If I do not use 'Specify the public address if different of the private service', the first mapping I do works very well and pass the traffic correctly. If I do, it does not. (I'm testing it trying to connect from the outside and I get a connection in the case of the former, but not in the latter scenario.) I generally choose tcp/aol as my test "public service" and are trying to connect to the external IP address on port 5190, which is the port for tcp/aol.)
  2. At the time wherever I try to do a second mapping, the system rejects saying «server address configuration comes into conflict with a rule of existing translation»
  3. Even if it worked, when I select "Public address specify if it is different from the private service", it only shows me the list of integrated service objects, not everything I've created. This isn't really the end of the world - I could divert just a series of services that we do not - but it would be nice if I could get actually ports my users are already using so that I could make a transparent exchange rather than giving them all the new connection information.

  Any thoughts would be greatly appreciated. I guess I'm missing something pretty obvious, but I'm not that knowledgeable about the Cisco ASA family at this point, I can probably use a few pointers get this working.

  Thank you!

  Hello

  There's something really weird happens with the end of your post. The second section of numbered points has its text completely messed. The lines of text are on top of eachother.

  I don't personally use the ASDM at all to configure ACL and NAT configurations.

  I could help with the configuration of CLI format however.

  Seems that you are trying to configure static PAT (Port Forwarding) for several internal hosts using the public IP address unique who will be on the external interface of the ASA.

  In general, you can use this format for all NAT configurations

  network of the object

  host

  NAT tcp service interface static (inside, outside)

  Naturally, the names of the interface may be different and could be "udp" instead of "tcp". Also since you can configure a large number of these I suggest you come up with a clear policy naming for your 'network of the object' so that they are easy to read and to clarify the purpose.

  Each 'object' that is created can be used on your external interface ACL to allow traffic. However if you want to configure a large number of these configurations PAT static and there are several ports for host even then it might be easier to make different 'object' to be used in the ACL list or it can be annoying.

  Could resemble a basic ACL corresponding to the "nat" above configuration rule

  access list permit tcp any eq object

  Once again the ACL above may look different in your use. You can limit the traffic of certain source addresses that would mean multiple ACL lines.

  Hope this helps

  -Jouni

• site to site vpn cisco 1811

  Hi guys

  Two sites are on connection MPLS and things work fine. Is now looking to connect a second ISP and create a failover site-to-site VPN. If the main ISP goes down (in the case of a power failure full at the ISP level which is unlikely, but just in case) then MPLS should failover site to site VPN which will be completely on a different secondary ISP. Can someone provide me with options as if I have to use ospf, bgp and ip sla? If the follow-up involved how can I follow the MPLS? is it even that track just interface or any special routing required? etc and... your help is greatly appreciated... Thank you...

  Hello

  It actually depends on what is already at work.

  I usually do with IP SLA is not running Routing Protocol, OSPF, BGP are always my first option.

  IP SLA parameters should be the same, just point to an available IP address accessible through the main connection and follow your routes using this instance.

  In terms of VPN, make sure the encryption card is on the secondary interface, and it should do.

  HTH.

  Portu.

  Please note all useful messages.

• Topology change syslog, how to disable messages?

  I have a number of switches BNT/Lenovo (8124, 8052, 8264) and all are connected to our central syslog server. I have quite a few switches in the same vlan, and I get a lot of topology messages of change like this:

  2016 03-11 T 05: 39:01.143556 - 07:00 Mar 11 05:39:07 switch-1 ALERT switch OS : STG 44, changing topology detected

  I don't necessarily need to see this. I would like to delete this message without Gohan other messages such as the STP root bridge changes. Is this possible? These seem to be my options from the side of the switch:

  8052b Journal (config) #logging?
  all all
  BGP BGP
  cfg Configuration
  cfgchg Configuration change notify
  CLI command line interface
  Console Console
  difference of Configuration monitoring difftrak
  dot1x 802. 1 x
  failover failover
  Hyperlinks Hotlinks
  IGMP IGMP-Group
  IGMP-mrouter IGMP mrouter
  applicant applicant IGMP IGMP
  IP Internet protocol address
  IPv6 IPv6
  LACP Link Aggregation Control Protocol
  system port link
  LLDP LLDP
  management management
  MLD MLD
  NETCONF NETCONF Configuration Protocol
  Time protocol NTP network
  OpenFlow enable logging of Protocol Openflow
  OSPF, OSPF
  OSPFv3 Ospfv3
  private - vlan, private VLAN
  RMON remote monitoring
  Syslog server server
  SLP Service Location Protocol
  Spanning-tree-group group Spanning tree
  SSH Secure Shell
  System
  Vlag Virtual Link Aggregation
  VLAN, VLAN
  VM Virtual Machine
  VRRP Virtual Router Redundancy Protocol
  Web Web

  I looked in the CLI guide for "journal of logging", but all I get is the following:

  [None] Journaling log []
  Displays a list of the features for which syslog messages can be generated. You
  can choose to turn on or off specific features (such as VLANs, stg, or ssh).
  or enable/disable syslog on all available functions.
  Control mode: global configuration

  There is no detail on the option does what exactly.

  I know that I probably can filter messages from syslog server-side but I would rather start the level for the switch.

  Thank you.

  Today, there is no way to delete these specific messages.

  They should not be too many and are often very useful to determine the cause of a failure.

  In order to reduce drastically the TCN BPDU is to put all the host ports such as 'edge' or 'portfast '.

  This setting prevent BPDUS and messages production when a host disconnect or connect to the switch.

  Then, only the 'real' TCN is recorded and useful for diagnosis.

  Ciao, Maurizio.

• Delete AIM account

  I saw the posts here on the deletion of an account of the AIM of the pre, but none of them does not work for me.  I think that I logged accidentally on an old account of GOAL because my buddies are added.  I can't do the remove account button be without shading to remove the information, because I don't want to use AIM on my pre.

  Any help to remove my phone account, so it is not drain my battery?

  in order to get the button "delete the account" for not being gray, you first you off target on the device (ditto for any account email, im, etc. - you must sign in first)-hope this helps...

• question of activeX cw graph3D time format

  With regard to the component works / ComponentWorks 3D chart control ActiveX OCX:

  I have a table of LabVIEW timestamp ("the default value is zero seconds since 12:00, Friday, January 1, 1904, universal time [01/01/1904 00:00:00] '") that I convert it to an array of Doubles.

  I would like to pass this array to the OCX (after conversion) as my y-axis. I have configured the OCX to display DD/MM/YYYY HH: mmusing the property editor. In addition, if you dig into the documentation of OCX, in the section that details the formatting strings, it is said:

  "The ActiveX control, the date is implemented as a floating-point value, measuring days from midnight, 30 December 1899. Thus, midnight, 31 December 1899, is represented by 1.0. Similarly, 06:00, January 1, 1900, is represented by 2.25, and midnight, 29 December 1899, is - 1.0. 06:00, 29 December 1899 is however - 1.25. To interpret the time portion, take the absolute value of the fractional part of the number. Thus, a second is equal to 1 / 24 hours / 60 minutes / 60 seconds, which is 1/86400 or about 1.157407e - 5. »

  Maybe my coffee is not strong enough today, but I don't see an easy way to convert the format of LabVIEW in the "ActiveX format" while properly accounting for leap years etc...

  My first hope is that someone already has, my backup plan is to have a good brainstorming on the forum on how to do this?

  Thanks for any input on this!

  I made a few changes that might be useful for others, or in the forum.

  In my case, I have an array of strings, which gives the date and time for when the data has been captured.

  The date and time strings were captured in another time zone of the computer where I run the analysis and visualization. Therefore, you must take care so that you don't end up adjust your time incorrectly based on your analysis computer-time zone schedules vs. where the data has been captured.

  I don't know if there may be a more smooth way and more optimized to do this, but I compared it and for data sets that I'm loading, the time required to perform this conversion is fairly trivial.

  I guess the point key to looking people should take away the format "chain" and "format of the string" VI is extremely powerful and his is worth the effort of learning of the March bump in the way to create the format specifier strings...

  

  The code in the image shows how to convert a string to the time format format OLE/ActiveX without changing time I have in the original string array. I can then feed what (in my case) table of axis y for the CW 3-d chart where my axis has been configured to display 'time' (container, right-click ActiveX, "CWGRAPH 3D--> properties", go to "format" tab, select your axis and choose the display format of your choice.)

  as by chance, doing the same use the xControl turns into a nightmare when the only solution I found was to use pairs of value and a lot of code to manage the positioning and the decimation of the value pairs to work correctly... Overall, my treatment has now passed a lot for next to nothing... and as a bonus, the CW graphic cursors use the same formatting settings, so that my date/times on the slider too, on the xControl, the use of cursors the part number of a pair value, so your cursor does not match your axis...

• Windows Media Player makes calls of NOR-fast Motion (Revisited)

  About 2 years ago, I posted a message on this forum about a condition where running Windows Media Player increased the rate that my Visual Basic 6 program has been able to contact a PCI-7344 Panel using calls OR-Motion (original post). To summarize the post, my VB program be called functions OR-Motion speed after that the computer is started and simply in the process of running Windows Media Player would allow my program make calls of NOR-faster Motion. I created a program demo, posted and was able to reproduce the situation constantly using several different computers & cards PCI-7344. However, no one at National Instruments could reproduce that; It seems that the calls function always ran fast for them and never ran slowly. I finally gave up and let the issue of dying and said reluctantly, our customers just start WMP to increase the speed of the machine.

  Now, I'm working on rewriting the software to the machine using VB.NET 2008 and Windows 7. My first hope was that the problem had gone with either the new VB, or Windows 7, but that doesn't seem to be the case. When I was with Windows XP, I could get recall for an improvement of the functions running WMP. With Windows 7, I can not get the increased rate even after the execution of WMP.

  Today, I took two new computers identical and loaded Windows XP on Windows 7 and one on the other. I put a new PCI-7344 card in each computer. I then installed version 8.2 of NO-Motion on each. With the exception of Microsoft .NET 3.5, which is necessary for my test VB.NET program, no other software has been installed, do not even Visual Basic. I started on each PC, ran my test program to determine the calls/sec, start Windows Media Player and my test program is represented. Here are the results:

  Test Windows XP & VB 6 program-128/s before launching WMP, 1024 Kbps after the execution of WMP

  Test of Windows XP & VB.NET 2008-128/s before WMP program, 1024 Kbps after WMP

  VB 6-256 calls/s before launching WMP, 256 Kbps calls after execution of WMP and Windows 7 test program

  Windows 7 test program and VB.NET - 256 Kbps calls before you launch WMP, 256 Kbps calls after execution of WMP

  As you can see, WMP has increased the rate of call of function OR-Motion on Windows XP, but has no effect in Windows 7. In addition, it did not matter which version of Visual Basic has been used.

  My first question is: what determines the rate at which he called on a NOR-Motion function? It seems that the maximum is 1024/s, which is consistent with what I saw 2 years ago even on slower computers. I would have thought that would be a faster PC function calls could also be made faster, but appears not to be the case. And is there some significance at 128, 256, and 1024 rates?

  My next question is: someone at - it else noticed faster or slower speeds using NOR-Motion after moving to Windows 7?

  The software that I work on the controls, a machine used on a production floor where the cycle time is critical and even save a fraction of a second can be important. With Windows XP, we have reduced the cycle time of 5 or 6 seconds by running WMP. We would like to start using Windows 7, but we won't be able to if it means cycle slower times on our machines.

  The source code for VB 6 and VB.NET 2008 for the demo program is attached. This is the computer that I used for the test today, but I was also able to reproduce this on computers Dell, LS, Xycom and Allen-Bradley. I also used several different versions of NOR-Motion and WMP with the same results.

  
  

• Windows 7 - why the priority of network adapter is ignored when you are connected to the area on a lower priority NIC?

  I have two network cards installed on my laptop.  I wanted to test and see how Windows 7 Ultimate managed the priority of the network adapters so I connected to a small Internet (NIC B) router, and the other on my domain (NIC A).
  First of all, it was a pain to find network adapter priority.  After some research and fun Google I found this.  Unfortunately, the search bar has not helped.
  Control Panel-> network and Internet-> view network status and tasks-> to modify the adapter-> Hold down 'alt' to bring up the menu "File"-> select 'Advanced'-> select 'Advanced settings' in the menu drop-down-> adjust your priorities of the adapter in the 'Advanced settings' window, under the tab "maps and links.

  With "B NIC", defined as the highest priority, I tried to browse the internet.  It was impossible to travel.  Then I disabled 'NIC A' (the NIC domain) and I can browse the internet.  Windows XP he handled this much better.

  Select 'NIC A', and then check 'NIC B' is the highest priority.  Then try tracert on www.google.com.  It refreshes my domain as the first hop router.  It seems to be completely ignoring 'NIC B', unless I have disable 'NIC A' completely.

  In case someone of another Vienna here, looking for the answer to this, as I did, I thought that putting the real solution to this question.  Many web pages say to change the priority of going on network connections and change the order there to what you like.  You don't have to bother with this setting.

  It does not work. He has apparently no effect on the use of connections.

  What Windows actually uses is the metric value for network connections.  The lowest metric value is tried first.  In my case, I have a connection broadband shabby home, but I can attach wireless on my phone for occasional good bandwidth.  So, I want to always use the connected wireless and ignore the wired connection, but still the chance to printers and other things on my network cable at the same time.  I want to keep both on and not to disable the wired when I use my phone.

  To resolve this problem for real, go to and right click your Wi-wired adapters and one at a time to change the properties.  Select IPv4, click and then .  For each of them, disable the "Automatic metric" checkbox and set the metric value manually.  I put the wireless cable and 1-2, which gave me the behavior I wanted.

  The Automatic metric is defined by Windows based on the speed of connection and a wired connection is generally faster than a wireless one.

• f2480

  Everest1 say HI.

  My f2480 print last page first.

  I would like to print in the order of first (page)

  first. hope you can help.

  Lead EVEREST1

  Hello

  OPEN & FAXES IN CONTROL PANEL PRINTER OF-> NOW MAKE A RIGHT ON YOUR PRINTER-> NOW CLICK, CLICK PRINTING PREFERENCES-> NOW, CLICK THE BASIC TAB-> NOW CHANGE YOUR PRINT COMMAND THAT IS BACK TO THE FRONT.

• You can select Add your ISP in your routing table

  Hi Tech support

  Ask a silly question

  You can add your ISP in your routing table, or is it just for subnets etc. to communicate to the outside world?

  In the affirmative. Can someone give me a link to do this

  I have a router MPS of 2691

  IOS is C2691-IPVOICEK9-M), Version 12.4 (25 d)

  Thanks in advance

  1 other question.

  Is implementation of a list of access via ip nat outside and inside of the only way to give devices internal internet access?

  Hi John,.

  Try this:

  Traceroute IP_ISP of your cme_router. If the first hop in the result table is your entry door and then nothing comes, maybe you should check the entry door.

  Concerning

• Switch SRW224G4P doesn't work anymore - leds blink normally

  Hello firstly, hope you have patience with another guy again.

  During the last two days, I had problems with the switch SRW224G4P.

  When normally connected to the network (among other switches), it does not ping and it does not switch packets (computers are unable to get the Hollows of IP DHCP addresses and communicate at all).

  When I tested with laptop connected directly (manually assigned IP), he replied ping and I was able to log in the Web GUI, but was not yet able to counicate more far.

  Have not had this problem before, not sure what to try that the switch is not covered by the warranty, no more.

  Help would be apreciated!

  Hi Bogdan, since it is possible to connect to the graphical interface, try factory default selector.

• 2 VPN tunnels on ASA common; A PRI a BKP at the same address-end peer

  Hi all

  I have an ASA 5505 branch that has 2 circuits ISP.  I have a data center ASA who has 1 ISP circuit. I have a VPN tunnel between the primary circuit ASA branch and the ASA circuit data center.  I would like to implement the ASA branch for the redundancy of the SLA so I can use primary and backup circuits, but two configs tunnel going to the same address-end peer, since the data center has only 1 ASA. I read that an ASA cannot have several tunnels to the same peer address because the ASA may have 1 SA by peer address.

  However, if I have my branch ASA configured for redundancy of the SLA, then only 1 tunnel would at once, which I think would affect the requirement of SA above.

  Can someone tell me if this is possible?

  Thank you.

  Hi Dean,

  You're right about things als because only link will be active at a time.

  On the ASA branch, you can apply the same encryption card to two primary and secondary circuit. You use just ALS to determine how this ASA branch will reach the address of peer card crypto (IP addr of ASA Data Center).

  I wrote an article about a similar scenario here: http://resources.intenseschool.com/using-vpn-tunnels-as-backup-links-primary-and-backup-vpn-tunnels-on-cisco-asa/