Traffic classifier UDP WAAS

Similar Questions

• WAAS 4.5 and Citrix - real field experience, anyone?

  Does anyone have experience in the field (a network of real customers, not a lab environment) of implementation of the AO Citrix on WAAS 4.5?

  • What scale of optimization is achieved?
  • Questions or problems?
  • Is it really as seemless, as suggested by Cisco/Citrix?
  • In short, it's rock?

  We have more than twenty boxes of WAVE in 4.5.1.  Sites running Citrix XenDesktop via a WYSE terminal see an average of 65% discount.  WYSE Terminals more we more reduction seems to be. (More current data cached).  XenApp traffic is optimized.  We ran 4.5.1 since December 9, 2011 with no problems.  We run it on SRE - 900L, 274, 474, 574, 594, 674, 7341 & a vWAAS-CM.  Everything was stable.

  You will need affect the classifier of Citrix ICA full optimization. (TFO/DRE/LZ).

  Boring oddity in this regard is that all classifier Citrix traffic comes under the name of the desktop app "remote."  So if you have RDP/3389 traffic that is not optimized and you have Citrix/1494 optimized traffic.  It will be reported under the same name of the application, what makes your reports are displayed with an optimization lower.  If you try to be creative and just rename the classifier of Citrix to use another name for the Application and follow, the acceleration of acceleration/monitor/ICA report will not display your ICA traffic.  You must let the Citrix ICA traffic classifier keep the name of the "Remote Desktop" application and rename all the other air that use desktop remotely to something else.  We used "Remote Desktop - other".  Version 5 and later as 4.5.5 should solve the problem.  Traffic classifier of Citrix will be marked with a unique Application name.

  Hope this helps

• Interception of WAAS WCCP on 6509

  Hello:

  I have a question about the use of WCCP interception in a basic design has collapsed.  We have a 6509 who has multiple connections to another provider of Wan services transmitted to him on IVR/routed ports.   "Redirection Ip wccp 62 in ' is used on all uplink for the different WAN service provider and" redirect Ip wccp 61 in ' is used on the virtual server's LAN interfaces.  How the interception of WCCP works when:

  1. traffic comes in uplink a WAN service provider and there is another uplink of Wan services provider both have a statement of "redirect ip wccp 62 in ' on uplink?  It's transit traffic that does not affect the server segment. WCCP knows not to send this traffic to the WAAS based on both interfaces have 'ip wccp 62 redirection"or maybe based on CEF research?  Or an ACL must be used to prevent inspection of transit traffic?

  2. traffic comes in uplink a WAN service provider with "redirect ip wccp 62 in ' and send to an interface that does not all configured redirection.  that is the traffic flow is a pair of "redirect the ip wccp 62 in ' and ' ip wccp redirect 61 in ' in the path.  This causes traffic in one direction to be inspected, but not the other way around?

  Thank you

  Patrick

  Hi Patrick,

  When you set up ' redirect to ' interface, 'Coming IN' on this interface, the traffic will be redirected to WAE.

  1: When traffic arrives on the interface WAN who has 'ip wccp 62 redirect' and leaves WAN another link that
  a 'ip wccp redirect 62.

  In this case when traffic arrives on the first WAN interface it will be redirected to WAE. The WAE will then be sent
  Back to its default gateway (IP forwarding). The Router forwards then out through the second WAN interface

  If you don't want that traffic to be redirected to WAE, you can then configure WCCP redirect list based on the access list
  to allow only the traffic intended for the segment of the server

  2: This will cause traffic only arriving on the interface that is 'ip wccp redirect 62' to be redirected to WAE.

  WCCP service 61 made redirect based on IP Source while service 62 is a redirect based on IP of Destination

  When the traffic arrives on the WAN interface that has ' ip wccp redirect 62 in ', it will redirect you to WAE based on the Destination
  address. The WAE will then returned it to its default gateway (IP forwarding). The router will route to the Destination.

  The answer to this Destination arrives on the interface which has not stated of 'ip wccp redirect', so it will not
  redirected to WAE.

  A point to remember, the traffic through WAE must be symmetric, which means to see the request and response
  so that it can optimize traffic

  Attached document provides detailed explanation of wccp.

  Hope this helps,

  Best regards
  Rahul

• [SOLVED] Problem with the ACB and InterVLAN routing

  Hello.

  I have Cisco 3750 G with IOS k9 - mz.150 - 2.SE4 Service of intellectual property. In my network, I have 4 VLANs with 4 internet gateways. I have set 4 static route for each gateways and with PBR to match this static routes. If I use "set ip next-hop" all traffic goes through the specific gateway interVlan routing does not work (I need to because the customers interVlan routing in different VLANS must be), and if I use 'set ip default next-hop', I was incapable of it attributed to Vlan (road-map lan14 not supported based on routing strategies).

  Model SDM is on the road that ip Routing is enabled.

  Here is my config for 2 of these VLANS:

  interface Vlan7
  IP 192.168.7.254 255.255.255.0
  IP access-group 107 to
  !
  interface Vlan14
  IP 192.168.14.254 255.255.255.0
  IP access-group 114 to
  !
  IP http server
  IP http secure server
  !
  !
  IP route 0.0.0.0 0.0.0.0 192.168.70.254
  IP route 0.0.0.0 0.0.0.0 192.168.140.254
  !
  access-list 107 permit udp any eq bootpc any eq bootps
  access-list 107 allow ip 192.168.7.0 0.0.0.255 any

  access-list 114 permit udp any eq bootpc any eq bootps
  access-list 114 allow ip 192.168.14.0 0.0.0.255 any

  lan7 allowed 10 route map
  corresponds to the IP 107
  IP 192.168.70.254 jump according to the value
  !

  lan14 allowed 10 route map
  corresponds to the IP 114
  IP 192.168.140.254 jump according to the value

  !

  Where is my error in config?

  Please help me, I'm stuck here almost three weeks.

  Hello

  You have created courses 2-card to set the next hop for a portion of the traffic classified with an acl.

  If you want any other traffic manager you must create an empty instance of your roadmap

  Example:

  lan7 allowed 10 route map

  football game...

  map of route allowed lan7 20 ==> Add this instance and leave it empty. You say the switch/router that he must refrain from other traffic but nothing to apply.

  Hope that this clear.

• GSS stuck "waiting for configuration data.

  One of my clients have 2 GSS 4900 running ver 4.1 (1)

  I can't get the ESG service works properly in a secondary gssm running. Gssm service looks like it starts but if I check "gss status" och "Show System State" that it is awaiting configuration data

  MNT - GSS - 002.nt.se #show - system status

  Standby GSS - 4.1 (1) GSSM - Cisco [Mar 12 Nov 16:10:21 UTC 2013]

  Recorded in primary GSSM: 10.16.0.15

  Component waiting for data routing configuration (wait a minute). [runmode = 3]

  START THE SERVER

  16:01 Config agent (crdirector)

  16:01 Config Server (crm)

  16:01 Database

  16:01 GUI Server (tomcat)

  16:01, Node Manager

  16:01 webserver (apache)

  Ping works fine between the GSS: are and there is no firewall involved (both are located on the same ip subnet).

  I did stop gss and then start gss. Waited for 24 hours, but the situation is the same.

  If I'm running tcpdump on the secondary, I see TCP traffic and UDP between the primary and the secondary, although all UDP packets have a warning of incorrect checksum.

  I have no idea on how to t-shoot, that. Should I do gss disable, remove this gss of the primary gssm and enable gss again in the secondary?

  Notice to lovers?

  Hello

  There seems to be a communication problem. You can do the following and see if the GSS is going to runmode = 5.

  On the standby: gss stop gss disable Then, go into the GUI of the GSSM and delete the standby GSS from the resources tab Then go to standby: gss enable gssm-standby x.x.x.x (IP of primary )
  
  Then in the GUI of primary GSSM, you will again see the standby in the resources tab. Click on it, and check on the activate button, then hit submit. Make sure the standby goes to runmode 5 under "gss status" output.
  If this doesn't work then you can try the below:
  Go to the GUI of the GSSM and delete the standby GSS from the resources tab. On the standby: gss stop restore-factory-defaults Make sure you have a console connection so you can do the initial config on the Standby GSS (add IP, etc). Once done, enter standby:
  
  gss enable gssm-standby x.x.x.x Then in the GUI of primary GSSM, you will again see the standby in the  resources tab.
  Click on it, and check on the activate button, then hit submit. Make sure the standby goes to runmode 5.
  
  Kind regards
  Kanwal
  		   

• Metadata for WebEX through proxy stream

  Hello

  My client is using WebEX meeting through a proxy server.

  Therefore, the port of destination of the WebEX package number is 8080.

  In this case, is the package identified by metadata stream?

  Kind regards

  Mitsuhiro

  Mitsuhiro salvation,

  If a proxy server is in the path between the customer of WebEx meeting and WebEx's data center. The flow between the client and server proxy will be represented by the metadata stream. Since the proxy to the WebEx datacenter server the flow will not be represented by metadata stream. It should be integration in the proxy to the proxy traversal (think of something similar to an ALG metadata) for metadata.

  [PC]-[proxy] - Internet-[WebEx DC]

  [PC] [proxy] will be covered for the metadata.

  [proxy] [WebEx DC] is not currently covered by metadata.

  In a situation of no-proxy (for example, the video stream below), metadata coverage would be between [PC] and until the NAT/FW.

  In the example below, the proxy server is 10.81.74.42 port 9090. The client is 10.4.9.12. There are 4 flows that are representative (control, data, data, and video). Video traffic is UDP traffic and directly by going to the Internet without going through a proxy. In other cases, the video stream itself could have through the proxy server.

  ====

  3009R1-BB0206 #show flow of metadata

  Return to Protocol DPort SPort entry exit SSRC

  7 10.81.74.42 10.4.9.12 TCP 9090 38319 Gi0 gi1/0/1 article 0

  5 10.81.74.42 10.4.9.12 TCP 9090 38313 Gi0 gi1/0/1 article 0

  6 10.81.74.42 10.4.9.12 TCP 9090 38315 Gi0 gi1/0/1 article 0

  8 64.68.119.235 10.4.9.12 UDP 9000 63300 Gi0 gi1/0/1 article 0

  3009R1-BB0206 #show metadata flow local-flow-id 5

  SPort DPort penetration Protocol I / F output I / F

  10.81.74.42 10.4.9.12 TCP 38313 9090 GigabitEthernet0/1 GigabitEthernet1/0

  Metadata attributes:

  Tag application: (414)

  Group application: webex

  Application provider: Cisco Systems, Inc..

  Application category: audio-video.

  Application under category: control and signalling

  Device application class: Office-conferences

  Type of media application: data

  Identifier of the unknown (147): [00 00 00 06]

  Identifier of the unknown (148): [00 00 00 06]

  Identifier of the unknown (150): [00 00 00 02]

  Application name: webex meeting

  Application version: T27

  Model of end Point: meeting webex customer - data

  Matching filters:

  Direction: IN:

  Direction: OUT:

  3009R1-BB0206 #show metadata flow local-flow-id 6

  SPort DPort penetration Protocol I / F output I / F

  10.81.74.42 10.4.9.12 TCP 38315 9090 GigabitEthernet0/1 GigabitEthernet1/0

  Metadata attributes:

  Tag application: (414)

  Group application: webex

  Application provider: Cisco Systems, Inc..

  Application category: audio-video.

  Application under category: control and signalling

  Device application class: Office-conferences

  Type of media application: data

  Identifier of the unknown (147): [00 00 00 06]

  Identifier of the unknown (148): [00 00 00 06]

  Identifier of the unknown (150): [00 00 00 02]

  Application name: webex meeting

  Application version: T27

  Model of end Point: meeting webex customer - data

  Matching filters:

  Direction: IN:

  Direction: OUT:

  3009R1-BB0206 #show metadata flow local-flow-id 7

  SPort DPort penetration Protocol I / F output I / F

  10.81.74.42 10.4.9.12 TCP 38319 9090 GigabitEthernet0/1 GigabitEthernet1/0

  Metadata attributes:

  Tag application: (414)

  Application name: webex meeting

  Group application: webex

  Application category: audio-video.

  Application under category: control and signalling

  Device application class: Office-conferences

  Media application type: control

  Application provider: Cisco Systems, Inc..

  Application version: t27

  Model of end Point: meeting customer webex - control

  Identifier of the unknown (147): [00 00 00 0a]

  Identifier of the unknown (148): [00 00 00 06]

  Identifier of the unknown (150): [00 00 00 02]

  Identifier of the unknown (149): [00 00 00 0a]

  Matching filters:

  Direction: IN:

  Direction: OUT:

  3009R1-BB0206 #show metadata flow local-flow-id 8

  SPort DPort penetration Protocol I / F output I / F

  64.68.119.235 10.4.9.12 UDP 63300 9000 GigabitEthernet1/0 GigabitEthernet0/1

  Metadata attributes:

  Tag application: (414)

  Application name: webex meeting

  Group application: webex

  Application category: audio-video.

  Application under category: voice-video-chat-collaboration

  Device application class: Office-conferences

  Application media type: video

  Application provider: Cisco Systems, Inc..

  Application version: t27

  Model of end Point: customer webex meeting - video

  Identifier of the unknown (147): [00 00 00 05]

  Identifier of the unknown (148): [00 00 00 02]

  Identifier of the unknown (150): [00 00 00 01]

  Matching filters:

  Direction: IN:

  Direction: OUT:

• L2TP/ipsec passthrough firewall of cisco router

  Hello! I have the following problem.

  External network users wish to connect internal Windows to network and share resources 2012 (start the software, files, etc)

  So it's time to deploy a vpn server and as I did not have a free license to run on my windows 2012, I decided to use my qnap for it (because it has this built-in feature) so I chose l2tp/ipsec and tested on the laboratory at home with simple tplink router with upnp function and it worked like a charm.

  However, in the real production environment, I need to use the cisco router, and this is how the story begins ;)

  Thus, clients with their machines say (7, 8.1, 10) must pass router cisco (with nat) firewall and access a vpn server and the internal network on qnap.

  I googled for sample configuration, but most of them related to the configuration of the router as a vpn server, and I want to achieve is to make my pass router vpn traffic. Once I found the same sample of pptp config, I have modified it a bit, but do not know if it works because I have not yet tested.

  In any case, could you check my config and see if it's ok? I'm doing a static nat for vpn 192.168.5.253 server to external address?

  Also, here is a short pattern

  vpn client VPN server (win 7,8,10)---routeur cisco 1921 - qnap)

  xxx.194 cloud 5,254 5.253 (internal network)

  test #show runn
  Building configuration...

  Current configuration: 3611 bytes
  !
  ! Last modified at 19:31:01 UTC Wednesday, may 4, 2016 configuration by
  !
  version 15.4
  horodateurs service debug datetime msec
  Log service timestamps datetime msec
  encryption password service
  !
  hostname test
  !
  boot-start-marker
  boot-end-marker
  !
  !
  enable secret $5
  !
  No aaa new-model
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  DHCP excluded-address IP 192.168.5.200 192.168.5.254
  DHCP excluded-address IP 192.168.5.1 192.168.5.189
  !
  pool dhcp IP network
  network 192.168.5.0 255.255.255.0
  router by default - 192.168.5.254
  network domain name
  xxx.x.xxx.244 DNS server
  !
  !
  !
  IP domain name temp
  IP cef
  No ipv6 cef
  !
  Authenticated MultiLink bundle-name Panel
  !
  CTS verbose logging
  !
  !
  license udi pid CISCO1921/K9 sn xxxxxx
  licence start-up module c1900 technology-package securityk9
  !
  !
  username secret abc 5
  username privilege 15 7 cisco password
  !
  redundancy
  !
  !
  !
  !
  !
  property intellectual ssh version 2
  !
  type of class-card inspect entire game cm_helpdek_protocols
  http protocol game
  https protocol game
  ssh protocol game
  type of class-card inspect entire game cm_gre_protocols
  Access-group name WILL
  type of class-card inspect entire game cm_icmp
  group-access icmp name game
  type of class-card inspect the correspondence cm_helpdesk
  match the name of group-access helpdesk
  type of class-card inspect entire game inside_to_outside
  h323 Protocol game
  match Protocol pptp
  ftp protocol game
  tcp protocol match
  udp Protocol game
  match icmp Protocol
  !
  type of policy-card inspect pm_outside_to_inside
  class type inspect cm_gre_protocols
  Pass
  class type inspect cm_icmp
  inspect
  class type inspect cm_helpdesk
  inspect
  class class by default
  Drop newspaper
  type of policy-card inspect pm_inside_to_outside
  class type inspect inside_to_outside
  inspect
  class type inspect cm_gre_protocols
  Pass
  class class by default
  Drop newspaper
  !
  area inside security
  Description inside the zone of confidence
  security of the outside area
  Outside the untrusted area description
  source of zonep_insiede_to_outside security pair area inside the destination outside
  type of service-strategy inspect pm_inside_to_outside
  source of zonep_outside_to_inside security zone-pair outside the destination inside
  type of service-strategy inspect pm_outside_to_inside
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  the Embedded-Service-Engine0/0 interface
  no ip address
  Shutdown
  !
  interface GigabitEthernet0/0
  Description 'LAN '.
  IP 192.168.5.254 255.255.255.0
  IP nat inside
  IP virtual-reassembly in
  security of the inside members area
  automatic duplex
  automatic speed
  !
  interface GigabitEthernet0/1
  Description "WAN CID: xxxxx".
  IP address xxx.xxx.xxx.194 255.255.255.252
  NAT outside IP
  IP virtual-reassembly in
  security of the outside Member area
  automatic duplex
  automatic speed
  !
  IP forward-Protocol ND
  !
  IP http server
  local IP http authentication
  no ip http secure server
  !
  IP nat pool network xxx.xxx.xxx.201 xxx.xxx.xxx.201 netmask 255.255.255.248
  IP nat inside source list 1 pool overload the network
  IP route 0.0.0.0 0.0.0.0 xxx.xxx.xxx.193
  !
  GRE extended IP access list
  Note ACL to allow ACCORD of PPTP OUTBOUND
  allow a gre
  permit any any eq udp 1701
  allow udp any any eq isakmp
  permit any any eq non500-isakmp udp
  helpdesk extended IP access list
  IP enable any host 192.168.5.253
  icmp extended IP access list
  allow icmp any host 192.168.5.253
  !
  !
  !
  access-list 1 permit 192.168.5.0 0.0.0.255
  !
  control plan
  !
  !
  !
  Line con 0
  local connection
  line to 0
  line 2
  no activation-character
  No exec
  preferred no transport
  transport output pad telnet, rlogin xxxxx
  StopBits 1
  line vty 0 4
  local connection
  transport input telnet ssh
  !
  Scheduler allocate 20000 1000
  !
  end

  Kind regards

  Andrew

  Once the client has been connected to the VPN, you want traffic back to flow to the client. Which can be easily received with "inspect".

  And from the point of view of the firewall, you do not have ESP-traffic (which would be the IP/50). You have only UDP traffic (initially UDP/500 which goes into UDP/4500)

  And you are right with your last ACE. That of a lot to permissive and not necessary for this function.

• Cisco RV016 not so Intelligent Balancer

  Hi all

  We have a problem with our routers of Cisco RV016 (we have 12 of them).

  Somehow the routers keep switching randomly between internet connections. (2-3 connections per router)

  We want to completely disable the load balancing and just use the internet connection from 2nd to 3rd as a failover (when the 1st connection is down)

  Load balancing breaks the session clients because the Middle session IP switch.

  Does anyone have a solution to this problem?

  We cannot deploy them like this and our distributor does not resume the boxes unopened with routers.

  We use:

  Firmware version: v4.2.2.08 (April 26, 2013 19:12:26)

  Kind regards

  Hi Wouter,

  We had the same problem. What I have done, is to create a rule in [System Management] - [Dual WAN] - [WAN 1--> configuration].

  The following rules are in my system:

  All traffic [TCP & UDP/1 ~ 65535]-> 192.168.1.1 ~ 192.168.1.254(0.0.0.0~0.0.0.0) [active] WAN1

  All traffic [TCP & UDP/1 ~ 65535]-> 192.168.1.1 ~ 192.168.1.254(0.0.0.0~0.0.0.0) [active] WAN2

  The rest of the settings:

  Enable Network Service detection: Yes

  Number of retries: 5

  Retry timeout: 30 seconds

  Case of failure: keep the system log and remove the connection

  Only [remote-host] checked with value 8.8.8.8

  Especially the setting with the remote host, the value 8.8.8.8 is important.

  Of course, it is possible to adjust it to the IP address of the modem, but this only works if the complete modem is turned off. For failover when the internet connection is down, assigning 8.8.8.8 works.

  Hope this helps you.

• RV042G Cisco vs Danish «nemID» public safety

  RV042G V01 Firmware v4.2.1.02 (18 January 2012 14:10:55) only works for IPv4. There is an active DynDNS WAN2-based account.

  I have had a problem with the RV042G because Bank and public safety systems "nemID" actually can see my two IP addresses and so "think" I'm fifling with the connection.

  In any case the result is that I'm up the offline. Anyone have any ideas?

  Thank you Bo.

  Follow these steps to set up the connection protocol

  • Navigate-> Dual WAN management system and ensure the balance of the load is enabled
  • Under the interface parameter go WAN1 and click on the configuration icon
  • Scroll to binding protocol
  • In the Select service page "all traffic [TCP & UDP/1 ~ 65535]".
  • Source IP address can be a range of consecutive IP or a single IP address for the test, select source IP as 1 machine IP as source of 192.168.1.10 to 192.168.1.10
  • Destination IP will be 0.0.0.0 to 0.0.0.0
  • The interface will be the WAN you want traffic to go on, and then click Activate, add to the list, and then save

  Finally, a test to see if it works. You can either go to the page your trying to access or you can go to an external site such as www.ipchicken.com and keep refreshing to see if your Ip address changes.

  

  

  -Tom
  Please mark replied messages useful

• Site to site VPN works only on Cisco 881

  I have 2 problems with a cisco 881. The first problem is that Vlan2 (192.168.5.xx) cannot access the internet on the outside. But I know that the router has internet, because I can ping the external ip address. The 2nd problem is that I have a set of site to another upward, but when I test the Site to site I get this error:

  destination of traffic of the tunnel must be channelled through the crypto map interface. The destination following (s) doesn't have a routing entry in the routing table
  192.168.2.0

  I copied the config form this router from another cisco 881 work, where everything works. The only difference is that this router needs a site to site vpn connection.

  My question is how I can get internet on vlan2 and who can I solve the connection to site to site.

  Here's the running configuration:

  Building configuration...

  Current configuration: 12698 bytes
  !
  version 15.3
  horodateurs service debug datetime msec
  Log service timestamps datetime msec
  no password encryption service
  !
  hostname Cisco_881
  !
  boot-start-marker
  boot-end-marker
  !
  AQM-registry-fnf
  !
  logging buffered 51200 warnings
  !
  AAA new-model
  !
  !
  AAA authentication login default local
  AAA authorization exec default local
  AAA authorization network default local
  !
  !
  !
  !
  !
  AAA - the id of the joint session
  !
  Crypto pki trustpoint TP-self-signed-1151531093
  enrollment selfsigned
  name of the object cn = IOS - Self - signed - certificate - 1151531093
  revocation checking no
  rsakeypair TP-self-signed-1151531093
  !
  Crypto pki trustpoint TP-self-signed-2011286623
  enrollment selfsigned
  name of the object cn = IOS - Self - signed - certificate - 2011286623
  revocation checking no
  rsakeypair TP-self-signed-2011286623
  !
  !
  TP-self-signed-1151531093 crypto pki certificate chain
  certificate self-signed 01
  3082022B 30820194 02020101 300 D 0609 2A 864886 F70D0101 05050030 A0030201
  2 060355 04031326 494F532D 53656 C 66 2 AND 536967 6E65642D 43657274 31312F30
  69666963 31313531 35333130 6174652D 3933301E 170 3135 30343031 31363230
  34315A 17 0D 323030 31303130 30303030 305A 3031 06035504 03132649 312F302D
  4F532D53 5369676E 656C662D 43 65727469 66696361 74652 31 31353135 65642D
  33313039 3330819F 300 D 0609 2A 864886 01050003, 818, 0030, 81890281 F70D0101
  8100AC6E E7FA8AFD 9D4E206C 2B23DFC1 990AFDB3 98CD84A7 37697253 A7EF2520
  0C45190E 298B6E9F E2711580 80DCFBFB 05A6A0BA 347B960B D9DA17FC B1543B9D
  FBC048F3 063EBBC5 02391432 F0232A73 EAC7278E 8CB83005 D13A1D47 BEF18198
  A 547469, 2 F65ED0E6 249BF517 1E74117D C94BE542 46EE487D A3843F12 364639B 4
  0B 090203 010001 HAS 3 53305130 1 130101 FF040530 030101FF 301F0603 0F060355
  551 2304 18301680 147996F4 3E6D0EE2 2D9065BB D726137C 2DF42ABE 01301D 06
  03551D0E 04160414 7996F43E 6D0EE22D 9065BBD7 26137C2D F42ABE01 300 D 0609
  2A 864886 F70D0101 8181002A 05050003 677B9BE6 CB60D188 73227C4B 2DC33101
  BD448017 EDEF0296 FF7438A3 4C46519B 144C775F 1429CF06 7DB29F2D EB16EE75
  22100B 63 0D75511A 98DC57DC EF87BED2 1C1635C8 B5352706 3963037A 4E9B739A
  3A1EC9BE 8431BD70 116D3B31 E4A2AC4C 0F934B3F 196AF829 AD537005 6935B 451
  EB31DB3F A9BA6D70 65B70D19 D00158
  quit smoking
  TP-self-signed-2011286623 crypto pki certificate chain
  no ip source route
  !
  !
  !
  !

  !
  DHCP excluded-address IP 10.10.10.1
  DHCP excluded-address IP 192.168.5.1 192.168.5.49
  DHCP excluded-address IP 192.168.5.150 192.168.5.254
  !
  DHCP IP CCP-pool
  import all
  Network 10.10.10.0 255.255.255.248
  default router 10.10.10.1
  Rental 2 0
  !
  IP dhcp Internet pool
  network 192.168.5.0 255.255.255.0
  router by default - 192.168.5.254
  DNS-Server 64.59.135.133 64.59.128.120
  lease 6 0
  !
  !
  !
  no ip domain search
  "yourdomain.com" of the IP domain name
  name of the IP-Server 64.59.135.133
  name of the IP-Server 64.59.128.120
  IP cef
  No ipv6 cef
  !
  !
  !
  !
  !
  Authenticated MultiLink bundle-name Panel
  !
  !
  !
  !
  !
  !
  !
  udi pid C881-K9 sn FTX18438503 standard license
  !
  !
  Archives
  The config log
  hidekeys
  username * privilege 15 secret 5 $1$IBY.$X5/iqYy47a5vAWWuG4/Oa/
  username * secret 5 $1$ 17 ST$ QzJMvQnZ9Q.1y7u0rYXFa0
  username * secret 5 $1$ L4W9$ zBKpawZ3i5nXxwyS9H6Lf1
  !
  !
  !
  !
  !
  no passive ftp ip
  !
  !
  crypto ISAKMP policy 1
  BA aes 256
  preshared authentication
  Group 2
  !
  crypto ISAKMP policy 2
  BA 3des
  preshared authentication
  Group 2
  isakmp encryption key * address 208.98.212.xx
  !
  Configuration group crypto isakmp MPE client
  key *.
  pool VPN_IP_POOL
  ACL 100
  include-local-lan
  10 Max-users
  netmask 255.255.255.0
  banner ^ practive entered the field

  This area is reserved for administrators of control systems.

  If you are here by mistake, please disconnect immediately.

  You have full access to 192.168.125.0 / 0.0.0.255

  Support on continue to start your session.              ^ C
  !
  Configuration group customer crypto isakmp PALL
  key *.
  pool VPN_IP_POOL_PALL
  ACL 101
  include-local-lan
  Max - 1 users
  netmask 255.255.255.0
  banner ^ practive entered the field

  This area is limited to the PALL access only.

  If you are here by mistake, please disconnect immediately.

  You have full access to 192.168.125.0 / 0.0.0.255

  Support on continue to start your session.            ^ C
  ISAKMP crypto profile vpn_isakmp_profile
  game of identity EMT group
  client authentication list default
  Default ISAKMP authorization list
  client configuration address respond
  virtual-model 1
  ISAKMP crypto profile vpn_isakmp_profile_2
  match of group identity PALL
  client authentication list default
  Default ISAKMP authorization list
  client configuration address respond
  virtual-model 2
  !
  !
  Crypto ipsec transform-set esp - aes 256 esp-sha-hmac VPN_TRANSFORM
  tunnel mode
  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
  tunnel mode
  !
  Profile of crypto ipsec VPN_PROFILE_MPE
  Set the security association idle time 3600
  game of transformation-VPN_TRANSFORM
  vpn_isakmp_profile Set isakmp-profile
  !
  Profile of crypto ipsec VPN_PROFILE_PALL
  Set the security association idle time 1800
  game of transformation-VPN_TRANSFORM
  vpn_isakmp_profile_2 Set isakmp-profile
  !
  !
  !
  map SDM_CMAP_1 1 ipsec-isakmp crypto
  Description Tunnel to208.98.212.xx
  the value of 208.98.212.xx peer
  game of transformation-ESP-3DES-SHA
  match address 102
  !
  !
  !
  !
  !
  !
  interface Loopback0
  IP 192.168.40.254 255.255.255.0
  !
  interface FastEthernet0
  no ip address
  !
  interface FastEthernet1
  no ip address
  !
  interface FastEthernet2
  switchport access vlan 2
  no ip address
  !
  interface FastEthernet3
  switchport access vlan 2
  no ip address
  !
  interface FastEthernet4
  IP address 208.98.213.xx 255.255.255.224
  IP access-group 111 to
  NAT outside IP
  IP virtual-reassembly in
  automatic duplex
  automatic speed
  map SDM_CMAP_1 crypto
  !
  type of interface virtual-Template1 tunnel
  IP unnumbered Loopback0
  ipv4 ipsec tunnel mode
  Tunnel VPN_PROFILE_MPE ipsec protection profile
  !
  tunnel type of interface virtual-Template2
  IP unnumbered Loopback0
  ipv4 ipsec tunnel mode
  Tunnel VPN_PROFILE_PALL ipsec protection profile
  !
  interface Vlan1
  Description of control network
  IP 192.168.125.254 255.255.255.0
  IP access-group CONTROL_IN in
  IP access-group out CONTROL_OUT
  IP nat inside
  IP virtual-reassembly in
  IP tcp adjust-mss 1452
  !
  interface Vlan2
  Description Internet network
  IP 192.168.5.254 255.255.255.0
  IP access-group INTERNET_IN in
  IP access-group out INTERNET_OUT
  IP nat inside
  IP virtual-reassembly in
  !
  local IP VPN_IP_POOL 192.168.40.100 pool 192.168.40.150
  local IP VPN_IP_POOL_PALL 192.168.40.151 pool 192.168.40.152
  IP forward-Protocol ND
  IP http server
  23 class IP http access
  local IP http authentication
  IP http secure server
  IP http timeout policy slowed down 60 life 86400 request 10000
  !
  !
  IP nat inside source static tcp 192.168.125.2 25000 25000 FastEthernet4 interface
  IP nat inside source overload map route SDM_RMAP_1 interface FastEthernet4
  IP route 0.0.0.0 0.0.0.0 FastEthernet4 permanent 208.98.236.xx
  !
  CONTROL_IN extended IP access list
  Note the access control
  Note the category CCP_ACL = 17
  allow any host 192.168.125.254 eq non500-isakmp udp
  allow any host 192.168.125.254 eq isakmp udp
  allow any host 192.168.125.254 esp
  allow any host 192.168.125.254 ahp
  IP 192.168.125.0 allow 0.0.0.255 192.168.125.0 0.0.0.255
  Note the VPN access
  IP 192.168.125.0 allow 0.0.0.255 192.168.40.0 0.0.0.255
  Note Access VNC
  permit tcp host 192.168.125.2 eq 25000 one
  Comment by e-mail to WIN911
  permit tcp host 192.168.125.2 any eq smtp
  Note DNS traffic
  permit udp host 192.168.125.2 host 64.59.135.133 eq field
  permit udp host 192.168.125.2 host 64.59.128.120 eq field
  Note Everything Else block
  refuse an entire ip
  CONTROL_OUT extended IP access list
  Note the access control
  IP 192.168.125.0 allow 0.0.0.255 192.168.125.0 0.0.0.255
  Note the VPN access
  ip permit 192.168.40.0 0.0.0.255 192.168.125.0 0.0.0.255
  Note Access VNC
  allow any host 192.168.125.2 eq 25000 tcp
  Comment by e-mail to WIN911
  allow any host 192.168.125.2 eq smtp tcp
  Note DNS responses
  allowed from any host domain eq 192.168.125.2 udp
  Note deny all other traffic
  refuse an entire ip
  INTERNET_IN extended IP access list
  Note Access VNC on VLAN
  allow any host 192.168.125.2 eq 25000 tcp
  Note block all other controls and VPN
  deny ip any 192.168.125.0 0.0.0.255
  deny ip any 192.168.40.0 0.0.0.255
  Note leave all other traffic
  allow an ip
  INTERNET_OUT extended IP access list
  Note a complete outbound Internet access
  allow an ip
  WAN_IN extended IP access list
  allow an ip host 207.229.14.xx
  Note PERMIT ESTABLISHED TCP connections
  allow any tcp smtp created everything eq
  Note ALLOW of DOMAIN CONNECTIONS
  permit udp host 64.59.135.133 eq field all
  permit udp host 64.59.128.120 eq field all
  Note ALLOW ICMP WARNING RETURNS
  allow all all unreachable icmp
  permit any any icmp parameter problem
  allow icmp all a package-too-big
  allow a whole icmp administratively prohibited
  permit icmp any any source-quench
  allow icmp all once exceed
  refuse a whole icmp
  allow an ip
  !
  auto discovering IP sla
  not run cdp
  !
  allowed SDM_RMAP_1 1 route map
  corresponds to the IP 103
  !
  access-list 1 remark out to WAN routing
  Note CCP_ACL the access list 1 = 16 category
  access-list 1 permit 192.168.125.2
  access-list 1 permit 192.168.5.0 0.0.0.255
  Note access-list 23 SSH and HTTP access permissions
  access-list 23 permit 192.168.125.0 0.0.0.255
  access-list 23 permit 192.168.40.0 0.0.0.255
  access-list 23 allow one
  Note access-list 100 VPN traffic
  access-list 100 permit ip 192.168.125.0 0.0.0.255 any
  access-list 100 permit ip 192.168.40.0 0.0.0.255 any
  Note access-list 101 for PALL VPN traffic
  access-list 101 permit ip 192.168.125.0 0.0.0.255 any
  Note access-list 102 CCP_ACL category = 4
  Note access-list 102 IPSec rule
  access-list 102 permit ip 192.168.5.0 0.0.0.255 192.168.2.0 0.0.1.255
  Note access-list 103 CCP_ACL category = 2
  Note access-list 103 IPSec rule
  access-list 103 deny ip 192.168.5.0 0.0.0.255 192.168.2.0 0.0.1.255
  access-list 103 allow ip 192.168.5.0 0.0.0.255 any
  access-list 103 allow the host ip 192.168.125.2 all
  Note access-list 111 CCP_ACL category = 17
  access-list 111 permit udp any host 208.98.213.xx eq non500-isakmp
  access-list 111 permit udp any host 208.98.213.xx eq isakmp
  access-list 111 allow esp any host 208.98.213.xx
  access-list 111 allow ahp any host 208.98.213.xx
  Note access-list 111 IPSec rule
  access-list 111 permit ip 192.168.2.0 0.0.1.255 192.168.5.0 0.0.0.255
  Note access-list 111 IPSec rule
  access-list 111 permit ip 192.168.2.0 0.0.1.255 192.168.4.0 0.0.1.255
  access-list 111 permit udp host 208.98.212.xx host 208.98.213.xx eq non500-isakmp
  access-list 111 permit udp host 208.92.12.xx host 208.92.13.xx eq isakmp
  access-list 111 allow esp host 208.92.12.xx host 208.92.13.xx
  access-list 111 allow ahp host 208.92.12.xx host 208.92.13.xx
  access-list 111 permit icmp any host 208.92.13.xx
  access-list 111 permit tcp any host 208.92.13.xx eq 25000
  access-list 111 permit tcp any host 208.92.13.xx eq 22
  access-list 111 permit tcp any host 208.92.13.xx eq telnet
  access-list 111 permit tcp any host 208.92.13.xx eq www
  !
  !
  !
  control plan
  !
  !
  !
  MGCP behavior considered range tgcp only
  MGCP comedia-role behavior no
  disable the behavior MGCP comedia-check-media-src
  disable the behavior of MGCP comedia-sdp-force
  !
  profile MGCP default
  !
  !
  !
  !
  exec banner ^ C
  % Warning of password expiration.
  -----------------------------------------------------------------------

  Unplug IMMEDIATELY if you are not an authorized user
  ^ C
  !
  Line con 0
  no activation of the modem
  line to 0
  line vty 0 4
  access-class 23 in
  password *.
  transport input telnet ssh
  transportation out all
  line vty 5 15
  access-class 160 in
  password *.
  transport of entry all
  transportation out all
  !
  max-task-time 5000 Planner
  Scheduler allocate 20000 1000
  !
  end

  Thank you.

  It seems that DNS has failed, because it is indeed happened to internet, but it does not work when internet DNS resolution.

  Go ahead and try to ping this 157.166.226.25, and it's on the browser http://157.166.226.25/, CNN.com. Let's try those. Also just in case where to configure a DNS SERVER on your router.

  - http://www.cisco.com/c/en/us/support/docs/ip/domain-name-system-dns/2418...

  Disable any ZBF just in case.

  David Castro,

  Kind regards

• Cisco IPsec VPn via a BT router

  Hi all

  A customer comes to buy a Cisco UC520 and is eager to VPN in the system with its IP communicator, do you know what are the settings that I have to configure it to allow the VPN through the BT router?

  Is this just a port before I need or is there some other parameters.

  Thank you

  Nathan

  Hi Nathan

  Do not have much with BT routers but what follows the document object should help

  http://btbusiness.custhelp.com/app/answers/detail/A_ID/9445/~/how-do-i-set-up-port-forwarding-on-the-BT-business-hub%3F

  Ports for VPN traffic are udp 500, 4500 & 10000

  It may be useful

• Problem of the NAC - Agent is a disconnect

  Hello

  We have a problem with the NAC in mode virtual outofband.

  AD SSO, sanitation, everything is working, but the strange things happening: after awhile, when downloading large files, Agent connects to the formula of network users, and the registration process is restarted.

  I disabled the pulsation clocks and timers, session, but we still have a problem.

  Also, while sniffing traffic on the switch port, I noticed that after have correctly connected you to the own Cisco Agent network always send traffic to UDP Port 8905. Is this a normal behavior?

  I noticed problems with this version of the agent causing connections to give up intermittently. I would upgrade to agent v4.1.3.1.

• Is there a troubleshooting guide for the connection of DSC-RX100M2 WiFi?

  Try to send a picture to my computer via the WiFi does not work.

  Of playback mode, when I select the menu option 'Send to the computer', the camera connects to the WiFi access point and then, is never able to connect to the computer...

  Name/group of computer job information been defined previously in the camera via USB with the help of PlayMemories House.

  After expire tries to connect to the computer, the reports of the camera that he was able to connect to the access point but not can connect to the computer.

  I already tried things

  (Please read this instead to suggest that I have try this... again)

  • I tried viewing pictures on a TV which is on the same network... and that works.
  • I tried to send photos to a "smart phone" (actually an android Tablet) connected to the same network... and it works.
  • I do not use the Windows Firewall so that the changes you home PlayMemories try to the firewall configuration Windows are not relevant.  So, I added some firewall rules for firewall, I use (Comodo) to allow incoming traffic on UDP and TCP protocols on ports 1900 and 2869 (as suggested in another post on this forum titled "Sony WX200 cannot connect to the computer via wifi".  I know it's another camera, but I guess the end of PlayMemories of the connection must use the same ports, etc..
  • I tried to connect with the products of firewall (Comodo) and the Windows Firewall completely disabled both.
  • I tried to restart the PMBDeviceInfoProvider service after the firewall rules have been added and then tried to connect the camera again, but always failed to connect.
  • I tried to restart the PMBDeviceInfoProvider service, while all products of firewalls have been disabled and then tried to connect the camera again, but always failed to connect.
  • I have temporarily stops the service of PMBDeviceInfoProvider and a simple http/web server (tiny Java Web Server - http://tjws.sourceforge.net/) port 2869 on the computer where PlayMemories Home is installed.  Then, using a web browser on another computer that is connected to the same WiFi access point that the RX100M2 camera, I was able to connect and get the default page of the web server.  If failure of the camera of the connection does not appear to be caused by a TCP connection failure and 2869 port is not blocked by the firewall.

  It does not appear to be any technical documentation or correct this information available about how the camera identifies and finds the computer, or what else can stop him from connect.  I speculate that it uses a UDP (port 1900) "broadcasting" of the PMBDeviceInfoProvider to allow the camera to find the computer.  I suspect that the "cannot connect" problem could be related to whether the wireless access point allows the UDP packets from the WiFi "side" of the wired/ethernet 'Coast' but I have no way to test or prove that, or even enough Sony documentation on the issue of whether it is a reasonable thing to try troubleshooting.

  If it gives anyone else having the same problem any ideas that lead to discovery, where it fails, please share.  If there is someone at Sony who knows what might be the cause of failure, please answer.

  Another thing I noticed is that a MTP IP device appears in Device Manager when you attempt to connect the camera, but it was not the name of camera model. I tried to uninstall the generic driver from "Device IP DPW" (right click and uninstall in Device Manager). The next time I tried to connect the camera, Windows RE-load the driver and now, it appears as DSC-RX100M2. So, I have evidence that the camera is now to find the computer, but it is yet to transfer all the files from the camera.

• Send UDP traffic for bandwidth test

  Hello

  I am fairly new to Labview and eager to learn more. I currently do some tests on our devices in network bandwidth. For the moment, I use the open source Iperf to send UDP traffic to the device. I wanted to do the same thing with Labview. All I need is to send a UDP traffic to different bandwidth to the device. I watched sender example VI in Labview and I don't see an option to set the bandwidth. Say for example, I would send 20 MB/s of device. Can you please help a beginner?

  Thank you.

  wythat wrote:

  Thanks Ben.

  Understand that. Am I safe to assume that the data in the UDP wirte string is one byte per character?

  Yes and keep in mind the network plug in bits per second not bytes.

  I think the overhead of package (envelope with source destination Protocol and are control) are all part of the flow. I usually count as 10-bit byte "in the head" is estimated.

  Ben

• Traffic UDP 8905 to default GW

  Hello

  I NAC deployment mode L2 OOB VGW and everything works fine. We see the FWSM, that has the L3 interface for VIRTUAL, bombarded by UDP port 8905 traffic local network access. I think that it is the case even after the PC have changed for access to the VLANS (as I see them in the list of online users and their switchport is in VIRTUAL local network access. Is this normal and how can we stop it from happening? I'm the host of the default discovery that is the IP of the CAM which of course is on a separate subnet. Please let me know

  Thank you

  Shaffeel

  Shaffeel,

  You are right on both counts.

  HTH,

  Faisal