swcth 2950 2901 router

Similar Questions

• 2901 router password recovery

  I need to drill a 2901 router to recover passwords.  Cisco methodology for the recovery of password on routers seriews 2900

  said to remove the compact flash card and restart in RMON.  There is no external flash on a 2901 memory card.  Is there a

  Compact flash card inside the box?  Or you can use the old method of restart and then hit CTRL + break to begin RMON?

  Thank you

  Howard Davis

  CCNP

  There is no external compact flash card on a 2901. 

  Yes it is.  It is hidden under a blanket of dust at the back (opposite side of the socket).

  There should be slots TWO cf.  Pop just the '0 '.

• 2901 router as an SSL VPN using

  Hello world!

  I was wondering if someone could give me a hand on this. I'm trying to use a Cisco 2901 to allow remote workers to access resources on the local network using the Client AnyConnect Secure Mobility Client. I just read this doco

  http://www.Cisco.com/c/en/us/support/docs/routers/3800-series-integrated...

  But it seems it does not support the 2901 platforms. I quote:

  WebVPN or VPN SSL technology relies on these router IOS platforms:

  • 870, 1811, 1841, 2801, 2811, 2821, no. 2851

  • 3725, 3745, 3825, 3845, 7200 and 7301

  Is that all just because this topic is old?

  Before I have to spend money on the wrong license, I decided to give it a go (above the following article). So, when I went to

  ' Configure > Security > VPN > SSL VPN > SSL VPN Manager "CCP says I need license"(securityk9). I then followed the link "activate license" and clicked on the tab 'evaluation licenses. But where there are two that seems good:

  • securityk9 (the CCP one says it needs)
  • SSL_VPN (one who seems reasonable as AnyConnect uses SSL VPN, right?)

  What is the license of right? Anyone can enlighten us please?

  Also, is there any resource that explains better than all the options and how to configure the AnyConnect on a router ISR2, using CLI?

  Thanks in advance

  Alvaro

  Hello Alvaro,

  What IOS version you are using?

  Beginning in Cisco IOS version 15.0 (1) M, the SSL VPN gateway is a licensing feature sits a count on Cisco 880, 890 Cisco, Cisco 1900, Cisco 2900 and 3900 Cisco platforms. A Chair does refers to the maximum number of sessions allowed both.

  For more information, go through:

  http://www.Cisco.com/c/en/us/TD/docs/iOS-XML/iOS/sec_conn_sslvpn/CONFIGU...

  "Please note useful posts.

• Copy the configuration of Cisco 881 to Cisco 2901

  We replace our router Cisco 881 with a Cisco 2901 router.  If I backup the configuration of the 881 and restore it on the 2901, will there be problems? We just want our 2901 to work the same. Thank you.

  routers/switches etc. can with a base image which may allow only certain features the devices come with these out of the box so that they work.

  You can buy advanced ip services images or images of advanced security that will allow all the features work. For example, you cannot use BGP or ACB unless you have an advanced picture, but you can be allowed to use RIP and EIGRP stub.

  You can check what is running on your 881 with a license to show what it will tell you what is on

• Which router to < 10 users?

  Hi all

  I was wondering what would be the best IOS router for remote sites with fewer than 10 users?

  Our remote sites need to connect to the central site 1 (star topology +) and at the moment we have about 4 remote sites. Most sites use Comcast Business Service (up to 50down/10up). We do not want to use the SAA, we would rather routers with integrated services.

  We want to connect all via the L2L IPSEC Tunnels and all spoke to communicate fully, but also with the VPN Clients. Our current Hub is a dry ASA5505 +, but we can be out in the near future for a Cisco 2901 router. We are looking for rock solid reliability, so if it's never going to the internet, the VPN will be arrived upward when the internet is back (a problem that we had in the past).

  I need as much as possible suggestions for our routers to Remote Site, so we can look over the options for the needs of our network!

  Thanks in advance!

  L2TP and IPSec is bread and butter for Cisco.  All you have to remember that for IPSec works, you must download the IOS that will allow encryption.  Also you also have an option as to the amount of DRAM desired.  It is preferable, in my view, to charge the maximum amount of DRAM to a router.

  You can get the router of 1900 but this, in my view, would be an overdose.

• Cannot access internal network so AnyConnect SSL VPN, ASA 9.1 (6)

  Hello Cisco community support,

  I have a lab which consists of two virtual environments connected to a 3750-G switch that is connected to a 2901 router which is connected to an ASA 5512 - X which is connected to my ISP gateway. I configured SSL VPN using AnyConnect and can establish a VPN to the ASA from the outside but once connected, I can't access internal network resources or access the internet. My information network and ASA configuration is listed below. Thank you for any assistance you can offer.

  ISP network gateway: 10.1.10.0/24

  ASA to the router network: 10.1.40.0/30

  Pool DHCP VPN: 10.1.30.0/24

  Network of the range: 10.1.20.0/24

  Development network: 10.1.10.0/24

  : Saved
  :
  : Serial number: FCH18477CPT
  : Material: ASA5512, 4096 MB RAM, CPU Clarkdale 2793 MHz, 1 CPU (2 cores)
  :
  ASA 6,0000 Version 1
  !
  hostname ctcndasa01
  activate bcn1WtX5vuf3YzS3 encrypted password
  names of
  cnd-vpn-dhcp-pool 10.1.30.1 mask - 255.255.255.0 IP local pool 10.1.30.200
  !
  interface GigabitEthernet0/0
  nameif inside
  security-level 100
  IP 10.1.40.1 255.255.255.252
  !
  interface GigabitEthernet0/1
  nameif outside
  security-level 0
  address IP X.X.X.237 255.255.255.248
  !
  interface GigabitEthernet0/2
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface GigabitEthernet0/3
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface GigabitEthernet0/4
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface GigabitEthernet0/5
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface Management0/0
  management only
  nameif management
  security-level 100
  IP 192.168.1.1 255.255.255.0
  !
  boot system Disk0: / asa916-1-smp - k8.bin
  boot system Disk0: / asa912-smp - k8.bin
  passive FTP mode
  permit same-security-traffic intra-interface
  network of the NETWORK_OBJ_10.1.30.0_24 object
  10.1.30.0 subnet 255.255.255.0
  network obj_any object
  network obj_10.1.40.0 object
  10.1.40.0 subnet 255.255.255.0
  network obj_10.1.30.0 object
  10.1.30.0 subnet 255.255.255.0
  outside_access_in list extended access permitted ip object NETWORK_OBJ_10.1.30.0_24 all
  FREE access-list extended ip 10.1.40.0 NAT allow 255.255.255.0 10.1.30.0 255.255.255.0
  access-list 101 extended allow any4 any4-answer icmp echo
  access-list standard split allow 10.1.40.0 255.255.255.0
  pager lines 24
  Enable logging
  asdm of logging of information
  Within 1500 MTU
  Outside 1500 MTU
  management of MTU 1500
  ICMP unreachable rate-limit 1 burst-size 1
  ICMP allow any inside
  ICMP allow all outside
  ASDM image disk0: / asdm - 743.bin
  don't allow no asdm history
  ARP timeout 14400
  no permit-nonconnected arp
  NAT (inside, outside) source obj_10.1.40.0 destination obj_10.1.40.0 static static obj_10.1.30.0 obj_10.1.30.0 non-proxy-arp-search to itinerary
  NAT (inside, outside) static source any any static destination NETWORK_OBJ_10.1.30.0_24 NETWORK_OBJ_10.1.30.0_24 non-proxy-arp-search to itinerary
  Access-group outside_access_in in interface outside
  !
  Router eigrp 1
  Network 10.1.10.0 255.255.255.0
  Network 10.1.20.0 255.255.255.0
  Network 10.1.30.0 255.255.255.0
  Network 10.1.40.0 255.255.255.252
  !
  Route outside 0.0.0.0 0.0.0.0 10.1.10.1 1
  Timeout xlate 03:00
  Pat-xlate timeout 0:00:30
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  Floating conn timeout 0:00:00
  dynamic-access-policy-registration DfltAccessPolicy
  without activating the user identity
  identity of the user by default-domain LOCAL
  Enable http server
  http 192.168.1.0 255.255.255.0 management
  http 192.168.1.0 255.255.255.0 inside
  http X.X.X.238 255.255.255.255 outside
  No snmp server location
  No snmp Server contact
  Crypto ipsec pmtu aging infinite - the security association
  Crypto ca trustpoint ASDM_Launcher_Access_TrustPoint_0
  registration auto
  full domain name no
  name of the object CN = 10.1.30.254, CN = ctcndasa01
  ASDM_LAUNCHER key pair
  Configure CRL
  trustpool crypto ca policy
  string encryption ca ASDM_Launcher_Access_TrustPoint_0 certificates
  certificate c902a155
  308201cd 30820136 a0030201 020204c 0d06092a 864886f7 0d 010105 9 02a 15530
  0500302b 31133011 06035504 03130 has 63 61736130 31311430 12060355 74636e64
  0403130 31302e31 2e33302e 32353430 1e170d31 35303731 32303530 3133315a b
  170d 3235 30373039 30353031 33315 has 30 2 b 311330 0403130a 11060355 6374636e
  64617361 30313114 30120603 55040313 0b31302e 312e3330 2e323534 30819f30
  0d06092a 864886f7 010101 05000381 8 d 0d 003081 89028181 00a47cfc 6b5f8b9e
  9b106ad6 857ec34c 01028f71 d35fb7b5 6a61ea33 569fefca 3791657f eeee91f2
  705ab2ea 09207c4f dfbbc18a 749b19ae d3ca8aa7 3370510b a5a96fd4 f9e06332
  4355 db1a4b88 475f96a1 318f7031 40668a4d afa44384 819d fa164c05 2e586ccc
  3ea59b78 5976f685 2abbdcf6 f3b448e5 30aa96a8 1ed4e178 0001300 020301 4 d d
  06092a 86 01010505 00038181 0093656f 639e138e 90b69e66 b50190fc 4886f70d
  42d9b4a8 11828da4 e0765d9c 52d84f8b 8e70747e e760de88 c43dc5eb 1808bd0f
  fd2230c1 53f68ea1 00f3e956 97eb313e 26cc49d7 25b927b5 43d8d3fa f212fcaf
  59eb8104 98e3a1d9 e05d3bcb 428cd7c6 61b530f5 fe193d15 ef8c7f08 37ad16f5
  d8966b50 917a88bb f4f30d82 6f8b58ba 61
  quit smoking
  Telnet timeout 5
  SSH stricthostkeycheck
  SSH timeout 5
  SSH group dh-Group1-sha1 key exchange
  Console timeout 0
  VPN-addr-assign local reuse / 360 time
  management of 192.168.1.2 - dhcpd address 192.168.1.254
  enable dhcpd management
  !
  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  Trust ASDM_Launcher_Access_TrustPoint_0 vpnlb-ip SSL-point
  SSL-trust outside ASDM_Launcher_Access_TrustPoint_0 point
  WebVPN
  allow outside
  AnyConnect image disk0:/anyconnect-linux-3.1.09013-k9.pkg 4
  AnyConnect image disk0:/anyconnect-macosx-i386-3.1.09013-k9.pkg 5
  AnyConnect image disk0:/anyconnect-win-3.1.09013-k9.pkg 6
  AnyConnect enable
  tunnel-group-list activate
  internal GroupPolicy_cnd-vpn group policy
  GroupPolicy_cnd-vpn group policy attributes
  WINS server no
  value of server DNS 8.8.8.8
  client ssl-VPN-tunnel-Protocol
  by default no
  xxxx GCOh1bma8K1tKZHa username encrypted password
  type tunnel-group cnd - vpn remote access
  tunnel-group global cnd-vpn-attributes
  address-cnd-vpn-dhcp-pool
  strategy-group-by default GroupPolicy_cnd-vpn
  tunnel-group cnd - vpn webvpn-attributes
  activation of the alias group cnd - vpn
  !
  ICMP-class class-map
  match default-inspection-traffic
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  maximum message length automatic of customer
  message-length maximum 512
  Policy-map icmp_policy
  icmp category
  inspect the icmp
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the rsh
  inspect the rtsp
  inspect esmtp
  inspect sqlnet
  inspect the skinny
  inspect sunrpc
  inspect xdmcp
  inspect the sip
  inspect the netbios
  inspect the tftp
  Review the ip options
  inspect the icmp
  !
  global service-policy global_policy
  service-policy icmp_policy outside interface
  context of prompt hostname
  no remote anonymous reporting call
  Cryptochecksum:261228832f3b57983bcc2b4ed5a8a9d0
  : end
  ASDM image disk0: / asdm - 743.bin
  don't allow no asdm history

  Can you confirm that this is correct, your diagram shows your IP address public on ASA as 30 while you have assinged on 'outside' interface like 29?

• CISCO2901 WITH SECURITY LICENSE PAK?

  Hello friends,

  Could you please help me to understand, what command do I I question to see if my 2901 router has the license of secuity? and what 12xxxxx I see in this output? Whithout license will I make a VPN for remote access?

  Any comments or document will be appreciated.

  Kind regards!

  Hello

  You can see that in the version of this router show. If you plan to use SSL based anyconnect VPN remote access you must acquire a license for the same thing.

  Number of concurrent users supported SSL VPN taken by platform

  Platform	Maximum number of users
  Cisco UC/SR500, routers series 880 and 890	10 users
  Cisco routers 1900 sets	25 registered users
  1941 and 2901 Cisco routers	75 registered users
  2911 and 2921 Cisco routers	100 users registered
  Routers Cisco 2951	150 users registered
  Routers Cisco 3900	200 users registered

  Concerning

  Knockaert

• Calculation of SSL VPN license

  Hello

  I need to purchase licenses for my SSL VPN (AnyConnect) 2901 router, and I would like to know how it is affected.

  If I buy a license 10 users, it is up to the 10 named user, or it is counted by concurrent users?

  If a user connects from a laptop computer and a mobile phone at the same time, with the same username, it counted as 2 user license, or just one?

  Also, AFAIK, the AnyConnect Essentials license is only available to ASA and not IOS routers. Is that still OK?

  Thank you.

  The number of licenses using simultaneous connections, regardless of the associated user ID.

  75 connected both unique usernames or a different user connected of 75 endpoints name would be count as 75 licenses in use. Laptop more phone = 2 users if the connections are simultaneous.

  The Essentials vs Premium distinction is unique to the ASA. Premium features only as a clientless SSLVPN, hostscan etc are not available based on the IOS SSL VPN

• 802.1 x intermediate switches

  As you watch the 802 configuration documentation. 1 x on the switches of the Cat series; There is a statement to the effect that some switches (2940 cat by CAT 3750) may be used as intermediaries. What this really means? What is the dashboard switch itself as the intermediary between the client and the authentication server? This means IF I use the 4506 cat, I can use intermediate between the 4506 and switch to the "pass-through" customer demand of 802. 1 x for the 4506? This means no doubt that intermediate switches can be used when the edge switch on their own?

  I guess from the documentation that no matter what the switch is used as the edge switch is the intermediary between the client and the authentication server.

  Any enlightenment will be appreciated.

  Diana

  Q: is this the dashboard switch itself as the intermediary between the client and the authentication server?

  R: Yes

  Q: you mean if I use the 4506 cat, I can use intermediate between the 4506 and switch to the "pass-through" customer demand of 802. 1 x for the 4506?

  A: not necessarily. You can directly use Cat4500 as intermediary.

  Q: surely, this means that the intermediate switches can be used as the edge turn on their own?

  A: no, you can use them as well as intermediate and edge.

  ***************************************************

  For 802. 1 x, intermediate devices can be Cat4000 series, Cat3550 Cat2950 or AP wireless. In other words, they are edge devices.

  The middleman here means that the device behaves like a proxy or 'intermediate' between the client device that asks for authentication of access (802.1 x) and the authentication server, for example the Cisco ACS server.

  Basically, what happened is, the switch will ask the client identification information (IE name of user and password), and then transmit the information to the ACS server. ACS server will check & verify the ID and will respond with the answer of SUCCESS or FAILURE to the switch. The switch will be in turn, grant or deny access to the client, based on the information/response.

  http://www.Cisco.com/en/us/products/hw/switches/ps628/products_configuration_guide_chapter09186a008007e8c4.html#xtocid2

  http://www.Cisco.com/en/us/products/hw/switches/ps663/products_configuration_guide_chapter09186a00800ddb0d.html#1133261

  Layer2 + 802.1 x NAC, devices that can act as intermediaries are Cat6500 (depend on worm IOS) Cat4500, Cat3750, Cat3560, Cat3550, Cat2960/2970/2955/2950/2940, router series C7600, switches from Cisco Gigabit Ethernet Switch Module (CGESM).

  http://www.Cisco.com/en/us/products/hw/switches/ps4324/prod_configuration_guide09186a00805764fd.html#wp1202047

  I hope this helps. Pls rate useful message (s).

  AK

• What has replaced the vpn concentrator?

  Greenhorn here, I was not to sit in this place.  We have three remote sites, sister of institutions, we share an app with.  Host us the app.  A site has a configuration of vpn concentrator, the other two use a leased from point to point line. They each have a router that connects to a single router.  They want to replace the lines leased by using a vpn.  Do the digging, I see that the hubs are EOL.

  So, what is used to replace the hub today?  What is a solution today from leased lines? They are all poor profit. My guess is that they will say look on Ebay for a hub if the solution is too expensive.

  Thanks Jim

  Jim

  The package of security (CISCO2901-SEC/K9 or CISCO2921-SEC/K9) is the convenient way to get the combination of the router, the software and licenses you will need. I don't think that you need something more elaborate than one of these security packages.

  I think one of these would be a good choice for you. It's been a while since I looked at the details of these routers. My recollection is that the 2921 offers more power, more interfaces and a few other benefits and would be attractive to many of us. But I think I understand your needs, I believe that the 2901 router cheaper and quite adequate for you.

  HTH

  Rick

• VPN IPSec does not work

  I am trying to set up a VPN between a 2901 router and 831, but I'm not having any success.  When I run crypto isakmp sa, I get this:

  cisco831 #sh crypto isakmp his
  IPv4 Crypto ISAKMP Security Association
  status of DST CBC State conn-id slot
  IPv6 Crypto ISAKMP Security Association

  It doesn't seem to be a sign of life.  I can access internet ok on both routers, but the failure of attempts to ping between the routers LAN IP.  I guess it's a problem of nat or access-list, but I don't know what I'm missing at this time.  Here are my configs:

  CISCO 2901
  version 15.0
  tcp KeepAlive-component snap-in service
  a tcp-KeepAlive-quick service
  horodateurs service debug datetime localtime
  Log service timestamps uptime
  encryption password service
  !
  host name 2901
  !
  boot-start-marker
  boot-end-marker
  !
  no logging rate limit
  no console logging
  Select the secret XXXXXXXXXXXXXXX

  !
  No aaa new-model
  !
  No ipv6 cef
  no ip source route
  IP cef
  !
  IP domain name mondomaine.fr
  inspect CBAC tcp IP name
  inspect the name CBAC icmp IP
  inspect the name CBAC udp IP
  !
  Authenticated MultiLink bundle-name Panel

  secret user name me XXXXXXXXXXXXXXX 5!
  redundancy
  !
  crypto ISAKMP policy 3
  BA 3des
  preshared authentication
  Group 2
  ISAKMP crypto key address 173.x.x.x mypassword
  !
  Crypto ipsec transform-set esp-3des esp-sha-hmac TRANSFORMSET
  !
  MYVPN 10 ipsec-isakmp crypto map
  the value of 173.x.x.13 peer
  game of transformation-TRANSFORMSET
  PFS group2 Set
  match address 199
  !
  interface GigabitEthernet0/0
  Description of the Internet
  IP address 173.x.x.x 255.255.255.248
  NAT outside IP
  IP inspect CBAC out
  IP virtual-reassembly
  automatic duplex
  automatic speed
  card crypto MYVPN
  !
  !
  interface GigabitEthernet0/1
  Description of LAN
  no ip address
  automatic duplex
  automatic speed
  !
  !
  interface GigabitEthernet0/1.1
  encapsulation dot1Q 2
  IP 192.168.1.1 255.255.255.0
  IP access-group 100 to
  penetration of the IP stream
  stream IP output
  IP nat inside
  IP virtual-reassembly
  !
  interface GigabitEthernet0/1.2
  encapsulation dot1Q 3
  IP 192.168.2.1 255.255.255.0
  IP access-group 101 in
  penetration of the IP stream
  IP nat inside
  IP virtual-reassembly
  !
  no ip forward-Protocol nd
  !
  IP http server
  IP http secure server
  IP flow-export GigabitEthernet0/1.1 source
  IP flow-export version 5
  flow IP 192.168.1.5 export destination 9996
  !
  overload of IP nat inside source list NAT interface GigabitEthernet0/0
  IP route 0.0.0.0 0.0.0.0 173.x.x.x
  !
  NAT extended IP access list
  ip permit 192.168.1.0 0.0.0.255 any
  !
  threshold of journal-update of 2147483647 IP access list
  recording of debug trap
  logging 192.168.1.5
  access-list 199 permit ip 192.168.1.0 0.0.0.255 172.20.0.0 0.0.0.255
  !
  control plan
  !
  Line con 0
  line to 0
  line vty 0 4
  exec-timeout 480 0
  password 7 XXXXXXXXXXXXXXX

  local connection
  entry ssh transport
  !
  Scheduler allocate 20000 1000
  end
  ************************************************************************
  CISCO 831
  Version 12.4
  no service button
  horodateurs service debug datetime msec
  Log service timestamps datetime msec
  encryption password service
  !
  hostname cisco831
  !
  boot-start-marker
  boot-end-marker
  !
  activate secret XXXXXXXXXXXXXXX!
  AAA new-model
  !
  !
  AAA authentication login me local
  !
  !
  AAA - the id of the joint session
  !
  !
  !
  !
  No dhcp use connected vrf ip
  DHCP excluded-address IP 172.20.0.1
  !
  IP dhcp pool mypool
  network 172.20.0.0 255.255.255.0
  WR domain name
  Server DNS 8.8.8.8
  router by default - 172.20.0.1
  !
  IP cef
  no ip domain search
  IP domain name mondomaine.fr
  !
  Authenticated MultiLink bundle-name Panel
  secret user name me 5 XXXXXXXXXXXXXXX

  !
  crypto ISAKMP policy 3
  BA 3des
  preshared authentication
  Group 2
  ISAKMP crypto key address 173.x.x.x mypassword
  !
  Crypto ipsec transform-set esp-3des esp-sha-hmac TRANSFORMSET
  !
  MYVPN 10 ipsec-isakmp crypto map
  the value of 173.x.x.x peer
  game of transformation-TRANSFORMSET
  PFS group2 Set
  match address 199
  !
  Archives
  The config log
  hidekeys
  !
  interface Ethernet0
  LAN description
  IP 172.20.0.1 address 255.255.255.0
  IP access-group 100 to
  IP nat inside
  IP virtual-reassembly
  !
  interface Ethernet1
  Description of the internet
  IP address 173.x.x.13 255.255.255.248
  NAT outside IP
  IP virtual-reassembly
  automatic duplex
  card crypto MYVPN
  !
  interface Ethernet2
  no ip address
  Shutdown
  !
  IP forward-Protocol ND
  IP route 0.0.0.0 0.0.0.0 173.x.x.14
  !
  no ip address of the http server
  no ip http secure server
  !
  overload of IP nat inside source list 100 interface Ethernet1

  Crypto-list extended IP access list
  ip licensing 172.20.0.0 0.0.0.255 192.168.1.0 0.0.0.255

  access-list 100 permit ip 172.20.0.0 0.0.0.255 any
  access-list 199 permit ip 172.20.0.0 0.0.0.255 192.168.1.0 0.0.0.255
  !
  control plan
  !
  Line con 0
  password 7 XXXXXXXXXXXXXXX

  no activation of the modem
  line to 0
  line vty 0 4
  privilege level 15
  transport input telnet ssh
  !
  max-task-time 5000 Planner
  end

  A few things that need to be changed:

  CISCO 2901:

  (1) ACL 100 applies to GigabitEthernet0/1.1, however, I do not see 100 ACL configured on the configuration.

  (2) ACL 101 is applied to GigabitEthernet0/1.2, however, I do not see that ACL 101 exists in the configuration.

  (3) NAT ACL must exempt traffic between 2 local networks as follows:

  NAT extended IP access list
  1 refuse ip 192.168.1.0 0.0.0.255 172.20.0.0 0.0.0.255

  CISCO 831:

  (1) ACL 100 is currently applied to the configuration section 2: NAT and Ethernet0. I would create a new ACL for instruction of NAT that should be added to the deny ACL (NAT exemption) as follows:

  access-list 150 deny ip 172.20.0.0 0.0.0.255 192.168.1.0 0.0.0.255

  access-list 150 permit ip 172.20.0.0 0.0.0.255 any

  overload of IP nat inside source list 150 interface Ethernet1

  no nat ip inside the source list 100 interface Ethernet1 overload

  Hope that helps.

• Collect data netflow on the load decrypted in IPSec traffic

  Hello

  I have a case where our customers have an IPSec Site to Site tunnel, where traffic is hair-pin on a 2901 router.

  They would collect netflow on the load decrypted for accounting purposes.

  The problem is that according to the order of operations on the router IOS, the netflow is recorded before the packet is decrypted penetration, and after the package is encrypted evacuation.

  Is there a solution to this, or someone has experience with alternative solutions for this scenario?

  (e.g. DURATION encrypted traffic to another device which decrypts and generate netflow data?)

  Best regards

  Steffen

  Hey, Steffen,.

  Yes the path of the EFC is so different [Card Crypto is a feature of output while the Tunnel Protection is a feature of post-encap].

  Therefore, we can apply all feature output such as netflow on a tunnel or a virtual-template interface since then we validate the traffic post-decapsulation.

  An example of one of my box [a vpn to 4.2.2.2 peer ping]. NetFlow which attracts traffic after decryption.

  R1 - HUB #sh ip cache flow. I Vi1

  Vi1 172.16.1.1 Et0/1 4.2.2.2 01 0000 0800 153

  See you soon,.

  Olivier

• Basis of routing on 2901

  Hey everybody

  Im a novice when it comes to Cisco routers. Having a 2901 in the House now and trying to do this route between the two main interfaces. But no luck!

  Routing is between the 10.16.108.x and the 32.54.20.x network. The command "ip routing" was launched.

  S * 0.0.0.0/0 [1/0] via 10.16.108.1
  10.0.0.0/8 is variably divided into subnets, 4 subnets, 3 masks
  C 10.0.0.0/23 is directly connected, Vlan1
  L 10.0.0.7/32 is directly connected, Vlan1
  C 10.16.108.0/22 is directly connected, GigabitEthernet0/0
  The 10.16.108.2/32 is directly connected, GigabitEthernet0/0
  32.0.0.0/8 is variably divided into subnets, 2 subnets, 2 masks
  C 32.54.16.0/20 is directly connected, GigabitEthernet0/1
  The 32.54.20.33/32 is directly connected, GigabitEthernet0/1

  The config set as a text file attachment.

  Everything looks good on this configuration for basic routing. Is the test on the 10.16.108.0 computer network configured to use 10.16.108.2 as its default gateway? Similarly, is the 32.54.20.32 network is configured to use 32.54.20.33 as its default gateway? If the test machines do not have a path to the interface of the router, which will create a problem.

• ALS IP Cisco 2901 and POLITICS with dual gateways LAN-based ROUTING

  Hello

  I am configuring a failover solution combined with the ACB using two bridges already configured. See the attached diagram.

  I currently have two ASA 5505 and a 2901.

  According to the example: http://www.firewall.cx/cisco-technical-knowledgebase/cisco-routers/861-c... I've set up the following in the 2901:

  Interface Port - channel1.1
  encapsulation dot1Q 1 native
  IP 192.168.200.100 255.255.255.0
  intellectual property policy map RM-Comcast-traffic route

  IP route 0.0.0.0 0.0.0.0 192.168.200.200 track 1
  IP route 0.0.0.0 0.0.0.0 192.168.200.150 track 2
  Route IP 10.10.10.1 255.255.255.252 192.168.200.150

  IP extended ACL-Comcast-traffic access list
  object-group permit COMCAST_Routed 192.168.200.0 0.0.0.255 any

  RM-Comcast-traffic route map permit 1
  corresponds to the IP ACL-Comcast-traffic
  set ip next-hop check availability 10.10.10.2 1 excerpt 2

  object-group service COMCAST_Routed
  Eq ftp TCP
  TCP eq www
  TCP eq ftp - data

  ALS IP 1
  ICMP echo - 192.168.200.200
  threshold 2
  timeout of 1000
  frequency 30
  IP SLA annex 1 point of life to always start-time now

  ALS IP 2
  10.10.10.2 ICMP echo
  threshold 2
  timeout of 1000
  frequency 30
  IP SLA annex 2 to always start-time life now

  track 1 accessibility of als 1 ip
  Track 2 accessibility of ALS 2 ip

  I did some tests and the part of failover seems to work but the configuration of the ACB does not work as expected. Only thing missing track 1 each time delivering properly and trak 2 is declining.

  Any help clarifying the feasibility and practicality of this configuration is greatly appreciated.

  Dan

  Adding a value of AD won't fix ACB (sorry if I gave that impression).

  On the client that you are testing with can you look it's the example routing table ' netstat - nr ' example and see what it shows in terms of gateways.

  It can be that you want to debug your routing policy to see what is happening on the router.

  Jon

• How to change my password for wifi on my printer Canon MG 2950

  How to change my Wifi password on my printer Canon MG 2950

  Hi Piet,

  Thanks for posting your query on the Microsoft Community.

  According to the description of the problem, you are ready to change your printer Canon MG 2950 WIFI password.

  Before connecting your PIXMA printer to your wireless network, check that you meet the following two conditions:

  1. Ensure that you have an access point (sometimes called a router or a hub) through which you get an Internet connection. Your access point must be fully functional before proceeding to the next step.
  2. Make sure you have a computing device, PC, Mac, tablet or Smartphone, here referred to as a computer that is connected to the Internet.

  I suggest you to return the item mentioned below and see if it helps allows you to change the password for WIFI.

  Setting up wireless PIXMA MG2950

  Use of the Machine with the Access Point Mode

  Hope that the information provided is useful. Let us know if you have any concerns related to Windows. We will be more than happy to help you.

  Kind regards