VLAN in two Cisco routers

Similar Questions

• Problem on the establishment of a GRE/IPsec tunnel between 2 cisco routers

  Hello world

  I am trying to establish a GRE IPsec tunnel between two cisco routers (2620XM and a 836).

  I created a tunnel interfaces on both routers as follows.

  2620XM

  interface Tunnel0

  IP 10.1.5.2 255.255.255.252

  tunnel source x.x.x.x

  tunnel destination y.y.y.y

  end

  836

  interface Tunnel0

  IP 10.1.5.1 255.255.255.252

  tunnel source y.y.y.y

  tunnel destination x.x.x.x

  end

  and configuration of isakmp/ipsec as follows,

  2620XM

  crypto ISAKMP policy 10

  md5 hash

  preshared authentication

  ISAKMP crypto key {keys} address y.y.y.y no.-xauth

  !

  !

  Crypto ipsec transform-set esp - esp-md5-hmac to_melissia

  !

  myvpn 9 ipsec-isakmp crypto map

  defined peer y.y.y.y

  Set transform-set to_melissia

  match address 101

  2620XM-router #sh ip access list 101

  Expand the access IP 101 list

  10 permit host x.x.x.x y.y.y.y host will

  836

  crypto ISAKMP policy 10

  md5 hash

  preshared authentication

  ISAKMP crypto key {keys} address x.x.x.x No.-xauth

  !

  !

  Crypto ipsec transform-set esp - esp-md5-hmac to_metamorfosi

  !

  myvpn 10 ipsec-isakmp crypto map

  defined peer x.x.x.x

  Set transform-set to_metamorfosi

  match address 101

  836-router #sh access list 101

  Expand the access IP 101 list

  10 licences will host host x.x.x.x y.y.y.y

  Unfortunately I had no isakmp security associations at all and when I enter the debugging to this output.

  CRYPTO: IPSEC (crypto_map_check_encrypt_core): CRYPTO: removed package as currently being created cryptomap.

  Any ideas why I get this result? Any help will be a great help

  Thank you!!!

  I think it's possible. It seems to me that you are assuming that the address of the interface where goes the card encryption is peering address. While this is the default action, it is possible to configure it differently.

  As you have discovered the card encryption must be on the physical output interface. If you want the peering address to have a different value of the physical interface address outgoing, then you can add this command to your crypto card:

  card crypto-address

  so if you put loopback0 as the id_interface then he would use loopback0 as peering address even if the card encryption may be affected on serial0/0 or another physical interface.

  HTH

  Rick

• Configuration of multiple L2L on cisco routers problems

  Hi all, I have two cisco routers (Cisco 2911 and 871) I'm trying to establish a VPN L2L with. Each has a VPN configured to our cooperate Office located to the top and work. I'm now trying to establish VPN site to site in these two remote sites. I have my cryptographic cards and NoNats valuable traffic however set up, I don't even see a coming phase upwards.

  I attached each config. Most of my experience of site to another is of pix and ASA, so I'm curious to know if there is something else I need to do on my external interface to allow several VPN?

  Can you see where I am going wrong?

  Thank you

  Dan

  Hi Dan,.

  You can only have one card encryption on an interface (as well as on Pix / Asa). However, this encryption card can have multiple entries.

  The Scottsdale router, so now instead of:

  card crypto Chandler-address FastEthernet4

  Chandler 2-isakmp ipsec crypto map

  ...

  !

  map Scottsdale address FastEthernet4 crypto

  Scottsdale 1 isakmp ipsec crypto map

  ...

  You must configure:

  map Scottsdale address FastEthernet4 crypto

  Scottsdale 1 isakmp ipsec crypto map

  ...

  Scottsdale 2-isakmp ipsec crypto map

  ...

  And of course, there must be a similar change on the other router.

  HTH

  Herbert

• PowerConnect switch and Cisco routers

  I have 4 Cisco routers connected to our Dell Powerconnect 7024. This is a laboratory environment where I'm having every act of router (2 per site) as a WAN gateway for these 2 sites.

  Site 1                                                                                                                           Site 2

  2 3 router

  PC - Dumb_switch PowerConnect Dumb_switch client - PC Client

  Router 1 router 4

  There are a few other Vlans on the switch with connected devices. With the current configuration, these two sites can communicate with any other "site" connected to the switch on each route, with the exception of the other.

  Directly connected to the router interfaces are in trunk mode, as it's the only way I could get the dell to connect with the Cisco. Ive read in other threads that the general mode is usually suggested on the powerconnect switch, but had no luck with this configuration.

  Router 1---> item in gi1/0/15 (vlan 10)

  Router 2---> item in gi1/0/14 (vlan 11)

  Router 3---> item in gi1/0/22 (vlan 16)

  Router 4---> article gi1/0/23 (vlan 14)

  Example: a ping from Site 1 can reach int 22 of the switch without problem, but I can't ping jump according to R3. As all the other devices on this switch can talk to these sites, I'm not clear if the problem is my config switch dell or routers. Any input would be greatly appreciated. Thank you!

  ! Current configuration:
  ! Description of the system "PowerConnect 7024, 5.1.2.3, VxWorks 6.6"
  ! 5.1.2.3 system software version
  ! 'Normal' system operation mode
  !
  Configure
  GVRP enable
  VLAN 2-7, 9-14, 16
  output
  VLAN 2
  name 'BOSTON '.
  output
  VLAN 3
  name "MIAMI".
  output
  VLAN 4
  name of 'THE
  output
  VLAN 5
  name "SEATTLE".
  output
  VLAN 6
  name "DALLAS".
  output
  VLAN 7
  name "London".
  output
  VLAN 9
  name "Frankfurt".
  output
  VLAN 10
  name "Rome".
  output
  VLAN 11
  name "Sczecin.
  output
  VLAN 12
  name "Budapest".
  output
  VLAN 13
  name "Moscow".
  output
  VLAN 14
  name "Quebec".
  output
  -Other - or ITU (q)
  VLAN 16
  name "Winnipeg".
  output
  hostname "Devlin".
  location 1/0 2. PowerConnect 7024
  clock timezone-5 minutes 0
  battery
  1 2 Member! PCT7024
  output
  out-of-band interface
  Shutdown
  output
  no ip domain-lookup
  "local" IP domain name
  IP routing
  IP route 0.0.0.0 0.0.0.0 172.16.37.3
  IP route 172.16.37.160 255.255.255.240 172.16.37.162
  IP route 172.16.37.112 255.255.255.240 172.16.37.162
  IP route 172.16.37.112 255.255.255.240 172.16.37.147
  IP route 172.16.37.144 255.255.255.240 172.16.37.147
  IP route 172.16.37.240 255.255.255.240 172.16.37.244
  IP route 172.16.37.224 255.255.255.240 172.16.37.244
  IP route 172.16.37.224 255.255.255.240 172.16.37.217
  -Other - or ITU (q)
  IP route 172.16.37.208 255.255.255.240 172.16.37.217
  ARP 172.16.37.162 0022.9057.7F51
  interface vlan 1
  IP 172.16.37.4 255.255.255.240
  bandwidth 10000
  IP ospf cost 10
  output
  interface vlan 2
  IP 172.16.37.17 255.255.255.240
  output
  interface vlan 3
  IP 172.16.37.33 255.255.255.240
  output
  interface vlan 4
  IP 172.16.37.49 255.255.255.240
  output
  interface vlan 5
  IP 172.16.37.65 255.255.255.240
  output
  interface vlan 6
  IP 172.16.37.81 255.255.255.240
  output
  interface vlan 7
  -Other - or ITU (q)
  IP 172.16.37.97 255.255.255.240
  output
  interface vlan 9
  IP 172.16.37.129 255.255.255.240
  bandwidth 10000
  output
  interface vlan 10
  IP 172.16.37.145 255.255.255.240
  bandwidth 1000
  IRDP IP
  output
  interface vlan 11
  IP 172.16.37.161 255.255.255.240
  bandwidth 1000
  IRDP IP
  output
  interface vlan 12
  IP 172.16.37.177 255.255.255.240
  bandwidth 100000
  output
  interface vlan 13
  IP 172.16.37.193 255.255.255.240
  bandwidth 1000
  output
  interface vlan 14
  IP 172.16.37.209 255.255.255.240
  bandwidth 1000
  output
  interface vlan 16
  IP 172.16.37.241 255.255.255.240
  bandwidth 1000
  IP ospf cost 100
  output
  No flowcontrol
  !
  interface item in gi1/0/3
  spanning tree portfast
  output
  !
  interface item in gi1/0/4
  spanning tree portfast
  output
  !
  interface item in gi1/0/5
  spanning tree portfast
  switchport access vlan 2
  output
  !
  interface item in gi1/0/6
  spanning tree portfast
  switchport access vlan 3
  output
  !
  interface item in gi1/0/7
  spanning tree portfast
  switchport access vlan 4
  output
  !
  interface item in gi1/0/8
  spanning tree portfast
  switchport access vlan 5
  output
  !
  interface item in gi1/0/9
  switchport access vlan 6
  output
  !
  interface item in gi1/0/10
  switchport access vlan 7
  output
  !
  interface item in gi1/0/11
  spanning tree portfast
  switchport mode trunk
  output
  !
  interface item in gi1/0/12
  spanning tree portfast
  switchport mode trunk
  output
  !
  interface item in gi1/0/13
  switchport access vlan 9
  output
  !
  interface item in gi1/0/14
  Speed 100
  full duplex
  switchport mode trunk
  switchport general allowed vlan add 10 tag
  switchport access vlan 10
  output
  !
  interface item in gi1/0/15
  Speed 100
  full duplex
  switchport mode trunk
  switchport general allowed vlan add 11 tag
  switchport access vlan 11
  output
  !
  interface item in gi1/0/16
  switchport access vlan 12
  output
  !
  interface item in gi1/0/17
  switchport access vlan 12
  output
  !
  interface item in gi1/0/18
  switchport access vlan 13
  output
  !
  interface item in gi1/0/19
  switchport access vlan 13
  output
  !
  interface item in gi1/0/22
  Speed 100
  full duplex
  switchport mode trunk
  switchport general allowed vlan add 16 tag
  switchport access vlan 16
  output
  !
  interface item in gi1/0/23
  Speed 100
  full duplex
  switchport mode trunk
  VLAN allowed switchport General add 14
  switchport access vlan 14
  output
  !
  interface item in gi1/0/24

  You could probably create a static route in Router 1 router 4 with a priority which is better than the other options, so we're going unless the link is down.

• VLAN on a Cisco 3750 G

  A VLAN is created on a Cisco 3750 G with the last IOS a 'good' way to secure a vmware network?  In this case, I'm hiding vmotion traffic, and the entire network is behind a firewall.  I realize, it would be better to have dedicated and isolated switch, but it's a VLAN on a reliable and secure Cisco switch? Or safety lies elsewhere, for example, encrypt the vmotion traffic or ACL solid?

  Sly-

  I think you got it nailed in your post there are some things you need to do when using VLANs to avoid trouble. The vulnerability referred to as Tom has to do with IOS/CatOS decoding of the VTP frames - just like we see in the Windows RPC/NetbIOS or SMB/CIFS vulnerabilities or other remotely exploitable vulnerabilities, it is possible to design a framework with malicious content that could overflow a buffer, string handling (uncommitted entry), double - frees, etc.. This type of vulns found often by "fuzzing" where you create bad images or images partially wrong and feed them in the unit under test, in the hope of finding an accident or create a denial of service. I remember simple tools like CITI (IP Stack Integrity Checker) to validate the equipment running and occasionally would cause you a switch to plant, especially the more IOS. So it is not limited to any control plane protocols such as VTP, this can also happen in the data plan. The data plan is much more robust because it is attack surface area is much more exposed to attacks that the protocols as VTP and a large number of problems have been corrected. If you look back in history, there are tons of questions of security in the Cisco data plan and other gear in less used features as options of ownership intellectual, management, the fragment of the types and codes rarely used ICMP, TCP sequence overflows. Now, I bet that if the security research community concentrated early protocols such as CDP, VTP and STP - you would have seen several vulnerabilities earlier.

  So to say "don't use VLANs otherwise, you are vulnerable due to a VTP vulnerability" is equivalent to say do not run IP using Cisco routers/switches when both IP and ICMP vulnerabilities exist in the data plan.

  Now, if you had followed that Cisco and other L2 switches providers recommend, you could be not to expose your VTP domain for such attacks and therefore, you are not vulnerable. Just as you would not expose your switches to receive Spanning Tree BPDU or dynamic routing of packets of protocol like OSPF, ISIS, or BGP of unapproved of speakers. Take a look at a blog I posted w/r/t this topic:

  http://blogs.VMware.com/Networking/2009/06/lets-talk-security-DMZs-VLANs-and-L2-attacks.html

  There is a lot of fear in the community about the attacks of L2, because networks and network devices are often a mystery to people server and a bad configuration L2 could be a source of security and stability problems. It is important to educate the community on the possible exposures, and VMware and other leaders of the market as Cisco take the responsibility to do.

  Disclosure on my part - I'm talking to and had operational experience of implementation and now one of the largest networks of data center global worldwide (Global Crossing/GlobalCenter-> later became the exodus-> Savvis) as one of network engineers senior and even 10 years back we would have data center with massive switch of the fabric that the guests accommodated like Yahoo , Ask Jeeves, etc. - isolated and segmented using VLANS. If you go in a large data center hosted today, you certainly would not get your own physical switch and backbone uplink - you would like to share a 6500, a foundry for 100 + often other customers or the great extreme.

• The way of writing to a wireless bridge between two different routers.1:broadband and dir 2:dlink 605 l

  I want to bridge.and wireless I can't do that... Please send me how to write to a wireless bridge between two different routers.

  1:broadband
  and
  2:Dlink dir 605 l,

  Hi Mohammed Ehsan Jourah,.

  Thanks for posting the request in the Microsoft community forums.
  I understand that you need to know how to make a wireless bridge between two different routers

  What version of the operating system is installed on the computer?

  To connect multiple computers, install a network adapter in each and run a network CAT5 cabling to connect each one to a hub (and thus the other.) The computer that will serve as a transition will have a standard network card for wired and a wireless network adapter that will connect to the wireless (WAP) access point or gateway on the second network.

  A network bridge is software or hardware that connects two networks or more so that they can communicate. You can create only a single bridge network on a computer, but a bridge can handle any number of network connections.

  You can try the steps at the bridge between two different routers wireless.
  a. determine the coverage area. When using two or more routers, the coverage area should be divided, and each router should be placed in a central location in each subdivision. If you add a wireless router to an existing network, this may mean moving the first router.
  b. decide which router is the main router. The main router is connected to the Internet, a LAN cable or other networks. It should be as close to the wired network connections or who has the best line of sight to another wireless network. In addition, the main router should be a high range router, allowing large tables of State and more users.
  c. buy a spare antenna, as the antennas that come with most routers do not have very good range. Quality omnidirectional antennas can push the range and signal strength of each of the routers, which, in turn, will reduce the cost by allowing routers less cover more space overall.
  d. deploy the primary router carefully. This router is the most important and requires most of the time of installation and options. Set the WEP (Protocol) encryption Service Set Identifier (SSID) and wireless, set up the Internet connection and test the router with some clients (computers). Once you get the main router deployed, deploy other routers should be easy.
  e. deploy the secondary routers, which must be configured to operate in "mode of transition." Secondary routers should be deployed around the perimeter of a large area or 'hot spots' where users placed - for example, will convene a bench Park or the table.

  Links:
  Create a network bridge:
  http://Windows.Microsoft.com/en-us/Windows7/create-a-network-bridge

  Add a connection to a network bridge:
  http://Windows.Microsoft.com/en-us/Windows7/add-a-connection-to-a-network-bridge

  Hope this information helps you. If you need to get help or information with decision-making wireless bridge between two different routers, I'll be happy to help you.

• How to connect and configure two wireless routers to provide the same connections across large areas?

  I have a big long House and prefer to use two wireless routers EA4500 to remote points to offer the same connections from one end to the other.

  How to make this wise (?) configuration

  @jcousie

  You can cascade two of them. Follow the steps on this link.

  Ann_18678
  Linksys technical support

• Help cascading two Linksys routers

  Hi, I tried to cascade two Linksys routers, but it did not work for me. Maybe you could help us. The first (which has the connection of the cable modem) is the brand new E4200, and the second is the former WRT54GCv3.

  That's how I want cascading them:

  ···································································
  Linksys E4200 ----(wireless)----(Desktop PC)·······················
  gw: 192.168.1.1 ·············|--(Laptop)···························
  ······|······················|--(iPad)·····························
  ······~······················|--(Home Server)······················
  ····(PLC)··························································
  ······~····························································
  ······|····························································
  Linksys WRT54GCv3 ·················································
  (Router mode|DHCP/NAT disabled) --(wireless)----(Playstation 3)····
  gw: 192.168.1.2 ·····························|--(Samsung BD-C8500)·
  ···································································
  

  However, the WRT54GCv3 does not receive the IP address of the DHCP E4200. I also tried to connect directly (without the PLC), even specifying a static IP address on the router second, but I got the same results.

  I have to State, that I will not change the gateway IP/first router because I have a web server and game works with a static IP address and I don't want to put it temporarily offline due to adjust the network settings.

  Thanks for your support!

  I searched the forum for you and found your answer.

  Go here for cascade two routers.

• Time-out for ARP cache on Cisco routers

  Hello

  I was reading a book on Cisco routers, in which the author said: "the router resets the age ARP meter to zero whenever he sees valid traffic from the corresponding device.» This ensures that the addresses of active devices are never emptied in the cache, regardless of how long they have been known. »

  I'm really surprised at this topic because I always thought the age counter ARP was an absolute of the meter and not compared to the last time a package was seen coming from the corresponding IP address. After reading this, I did a few tests that tend to confirm the age counter ARP is absolute and that he cares not if we have movement active in the corresponding period of INQUIRY or not.

  : Question 1 can someone confirm this please?

  I am unable to find clear statements in the Cisco documentation.

  QUESTION 2: when the router sends a new ARP request?

  For example, when the time-out of the ARP is 4 hours or 240 minutes (default value of Cisco), the router sends an ARP request reaching 239 minutes (1 minute before the expiration time). This value is a fixed (send us a 1 minute before aging ARP request) or is it a relative value (x % of the value of timeout)?
  

  Thanks for your help.

  Sam

  I have some additional information that might help. I found an ad of a Cisco engineer, which gives some information about the behavior of ARP in Cisco IOS. He said clearly (and is an example) that if Cisco receives an ARP to a host request it will use this request to refresh the ARP entry and reset the timer so that the entrance without making its own application ARP. Maybe that's the behavior they were trying to talk in the IOS Cookbook.

  It also speaks to a unicast ARP request 60 seconds before the expiration of the entry so that the entry can be updated. It does not specifically say, but I think that this interval is fixed.

  Here is the link if you want to see the details:

  http://puck.nether.NET/pipermail/Cisco-NSP/2005-February/017400.html

  Regarding the error in the book, I worked as an examiner on a few pounds and can tell you that the authors and reviewers are working hard to do the right thing. But sometimes mistakes are not captured and appear in the publication. With the amount of detail covered in the book some mistakes are bound to crawl through.

  HTH

  Rick

• VLAN between two routers

  Hello. I am trying to solve a practical problem and I can't seem to deliver the VLAN. The presentation is as follows:

  You have two two routers connected to each other. Each router has a switch and each switch has four related generic PC. Each PC on this switch belongs on its own VIRTUAL local network. Thus,.

  Switch 1	Switch 2
  PC A - VLAN 10	PC E - VLAN 10
  PC B - VLAN 20	PC F - VLAN 20
  PC C - VLAN 30	PC G - VLAN 30
  PC D - VLAN 40	PC H - VLAN 40

  So A PC on the router/switch 1 1 can ping ROUTER2/switch 2 E PC and it cannot ping all the others. So on and so forth.

  So I tried to adjust the C VLAN 10 PC to check if the configuration of my work, and it does. But then I tie my router and sub interfaces, set the fa0/1 interface on my switch such as trunk and permit VLAN 10, 20, 30 and 40. Now, all PC on the router can ping each other! That should not happen. Now I don't know what the problem is. Can someone help me?

  I have attached the docx and the tracer file package.

  Sorry that I just realized you don't want connectivity between all computers.

  Which is a relief, because watching your Setup, I didn't see why they wouldn't be able to :-)

  You must use the ACLs on your subinterfaces to allow only the traffic you want.

  If you want to allow any PC from any other PC on the same site to ping but only the PC in the same vlan on the other site, then use an outbound acl on the router serial interfaces.

  If you only want to allow ping between the PC in the same vlan ACL use traffic entering on the subinterfaces.

  Jon

• Problem with the VPN site to site for the two cisco asa 5505

  Starting with cisco asa. I wanted to do a vpn site-to site of cisco. I need help. I can't ping from site A to site B and vice versa.

  Cisco Config asa1

  interface Ethernet0/0
  switchport access vlan 1
  !
  interface Ethernet0/1
  switchport access vlan 2
  !
  interface Vlan1
  nameif outside
  security-level 0
  IP address 172.xxx.xx.4 255.255.240.0
  !
  interface Vlan2
  nameif inside
  security-level 100
  IP 192.168.60.2 255.255.255.0
  !
  passive FTP mode
  network of the Lan_Outside object
  192.168.60.0 subnet 255.255.255.0
  network of the NETWORK_OBJ_192.168.1.0_24 object
  subnet 192.168.1.0 255.255.255.0
  network of the NETWORK_OBJ_192.168.60.0_24 object
  192.168.60.0 subnet 255.255.255.0
  object-group Protocol DM_INLINE_PROTOCOL_1
  ip protocol object
  icmp protocol object
  object-group Protocol DM_INLINE_PROTOCOL_2
  ip protocol object
  icmp protocol object
  object-group Protocol DM_INLINE_PROTOCOL_3
  ip protocol object
  icmp protocol object
  Access extensive list ip 192.168.60.0 Outside_cryptomap allow 255.255.255.0 192.168.1.0 255.255.255.0
  Outside_cryptomap list extended access allow DM_INLINE_PROTOCOL_3 of object-group a
  Outside_access_in list extended access allow DM_INLINE_PROTOCOL_1 of object-group a
  Inside_access_in list extended access allow DM_INLINE_PROTOCOL_2 of object-group a
  network of the Lan_Outside object
  NAT (inside, outside) interface dynamic dns
  Access-group Outside_access_in in interface outside
  Inside_access_in access to the interface inside group
  Route outside 0.0.0.0 0.0.0.0 172.110.xx.1 1
  Timeout xlate 03:00
  Pat-xlate timeout 0:00:30
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  Floating conn timeout 0:00:00
  dynamic-access-policy-registration DfltAccessPolicy
  identity of the user by default-domain LOCAL
  AAA authentication http LOCAL console
  Enable http server
  http 192.168.60.0 255.255.255.0 inside
  http 96.xx.xx.222 255.255.255.255 outside
  No snmp server location
  No snmp Server contact
  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA-TRANS-aes - esp esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-TRANS-aes - esp esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac
  Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-DES-SHA-TRANS esp - esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-DES-MD5-TRANS esp - esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transit
  Crypto ipsec ikev2 ipsec-proposal OF
  encryption protocol esp
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 proposal ipsec 3DES
  Esp 3des encryption protocol
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal AES
  Esp aes encryption protocol
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal AES192
  Protocol esp encryption aes-192
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 AES256 ipsec-proposal
  Protocol esp encryption aes-256
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec pmtu aging infinite - the security association
  card crypto Outside_map 1 corresponds to the address Outside_cryptomap
  card crypto Outside_map 1 set peer 96.88.75.222
  card crypto Outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
  card crypto Outside_map 1 set ikev2 AES256 AES192 AES 3DES ipsec-proposal OF
  Outside_map interface card crypto outside
  trustpool crypto ca policy
  IKEv2 crypto policy 1
  aes-256 encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 10
  aes-192 encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 20
  aes encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 30
  3des encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 40
  the Encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  Crypto ikev2 allow outside
  Crypto ikev1 allow outside
  IKEv1 crypto policy 10
  authentication crack
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 20
  authentication rsa - sig
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 30
  preshared authentication
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 40
  authentication crack
  aes-192 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 50
  authentication rsa - sig
  aes-192 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 60
  preshared authentication
  aes-192 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 70
  authentication crack
  aes encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 80
  authentication rsa - sig
  aes encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 90
  preshared authentication
  aes encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 100
  authentication crack
  3des encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 110
  authentication rsa - sig
  3des encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 120
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 130
  authentication crack
  the Encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 140
  authentication rsa - sig
  the Encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 150
  preshared authentication
  the Encryption
  sha hash
  Group 2
  life 86400
  Telnet timeout 5
  SSH stricthostkeycheck
  SSH timeout 5
  SSH group dh-Group1-sha1 key exchange
  Console timeout 0
  inside access management

  dhcpd address 192.168.60.50 - 192.168.60.100 inside
  dhcpd allow inside
  !
  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  WebVPN
  AnyConnect essentials
  internal GroupPolicy_96.xx.xx.222 group strategy
  attributes of Group Policy GroupPolicy_96.xx.xx.222
  VPN-tunnel-Protocol ikev1, ikev2
  username admin privilege 15 encrypted password f3UhLvUj1QsXsuK7
  tunnel-group 96.xx.xx.222 type ipsec-l2l
  tunnel-group 96.xx.xx.222 General-attributes
  Group - default policy - GroupPolicy_96.xx.xx.222
  96.XX.XX.222 group of tunnel ipsec-attributes
  IKEv1 pre-shared-key *.
  remote control-IKEv2 pre-shared-key authentication *.
  pre-shared-key authentication local IKEv2 *.
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  maximum message length automatic of customer
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the rsh
  inspect the rtsp
  inspect esmtp
  inspect sqlnet
  inspect the skinny
  inspect sunrpc
  inspect xdmcp
  inspect the sip
  inspect the netbios
  inspect the tftp
  Review the ip options
  inspect the icmp
  inspect the icmp error

  ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

  Cisco ASA 2 config

  interface Ethernet0/0
  switchport access vlan 1
  !
  interface Ethernet0/1
  switchport access vlan 2
  !
  interface Vlan1
  nameif outside
  security-level 0
  IP address 96.xx.xx.222 255.255.255.248
  !
  interface Vlan2
  nameif inside
  security-level 100
  IP 192.168.1.254 255.255.255.0
  !
  passive FTP mode
  permit same-security-traffic inter-interface
  permit same-security-traffic intra-interface
  network of the Lan_Outside object
  subnet 192.168.1.0 255.255.255.0
  network of the NETWORK_OBJ_192.168.60.0_24 object
  192.168.60.0 subnet 255.255.255.0
  network of the NETWORK_OBJ_192.168.1.0_24 object
  subnet 192.168.1.0 255.255.255.0
  object-group Protocol DM_INLINE_PROTOCOL_1
  ip protocol object
  icmp protocol object
  object-group Protocol DM_INLINE_PROTOCOL_2
  ip protocol object
  icmp protocol object
  object-group Protocol DM_INLINE_PROTOCOL_3
  ip protocol object
  icmp protocol object
  object-group Protocol DM_INLINE_PROTOCOL_4
  ip protocol object
  icmp protocol object
  Outside_cryptomap list extended access allow DM_INLINE_PROTOCOL_2 of object-group 192.168.1.0 255.255.255.0 192.168.60.0 255.255.255.0
  Outside_cryptomap list extended access allow DM_INLINE_PROTOCOL_3 of object-group a
  Outside_access_in list extended access allow DM_INLINE_PROTOCOL_1 of object-group a
  Inside_access_in list extended access allow DM_INLINE_PROTOCOL_4 of object-group a
  pager lines 24
  Enable logging
  asdm of logging of information
  Outside 1500 MTU
  Within 1500 MTU
  no failover
  ICMP unreachable rate-limit 1 burst-size 1
  don't allow no asdm history
  ARP timeout 14400
  no permit-nonconnected arp
  NAT (inside, outside) static source NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.60.0_24 NETWORK_OBJ_192.168.60.0_24 non-proxy-arp-search of route static destination
  !
  network of the Lan_Outside object
  dynamic NAT (all, outside) interface
  Access-group Outside_access_in in interface outside
  Inside_access_in access to the interface inside group
  Route outside 0.0.0.0 0.0.0.0 96.xx.xx.217 1
  Timeout xlate 03:00
  Pat-xlate timeout 0:00:30
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  Floating conn timeout 0:00:00
  dynamic-access-policy-registration DfltAccessPolicy
  identity of the user by default-domain LOCAL
  AAA authentication http LOCAL console
  Enable http server
  http 192.168.1.0 255.255.255.0 inside
  http 172.xxx.xx.4 255.255.255.255 outside
  No snmp server location
  No snmp Server contact
  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA-TRANS-aes - esp esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-TRANS-aes - esp esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac
  Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-DES-SHA-TRANS esp - esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-DES-MD5-TRANS esp - esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transit
  Crypto ipsec ikev2 ipsec-proposal OF
  encryption protocol esp
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 proposal ipsec 3DES
  Esp 3des encryption protocol
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal AES
  Esp aes encryption protocol
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal AES192
  Protocol esp encryption aes-192
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 AES256 ipsec-proposal
  Protocol esp encryption aes-256
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec pmtu aging infinite - the security association
  card crypto Outside_map 1 corresponds to the address Outside_cryptomap
  card crypto Outside_map 1 set peer 172.110.74.4
  card crypto Outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
  card crypto Outside_map 1 set ikev2 AES256 AES192 AES 3DES ipsec-proposal OF
  Outside_map interface card crypto outside
  trustpool crypto ca policy
  IKEv2 crypto policy 1
  aes-256 encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 10
  aes-192 encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 20
  aes encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 30
  3des encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 40
  the Encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  Crypto ikev2 allow outside
  Crypto ikev1 allow outside
  IKEv1 crypto policy 10
  authentication crack
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 20
  authentication rsa - sig
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 30
  preshared authentication
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 40
  authentication crack
  aes-192 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 50
  authentication rsa - sig
  aes-192 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 60
  preshared authentication
  aes-192 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 70
  authentication crack
  aes encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 80
  authentication rsa - sig
  aes encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 90
  preshared authentication
  aes encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 100
  authentication crack
  3des encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 110
  authentication rsa - sig
  3des encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 120
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 130
  authentication crack
  the Encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 140
  authentication rsa - sig
  the Encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 150
  preshared authentication
  the Encryption
  sha hash
  Group 2
  life 86400
  Telnet timeout 5
  SSH stricthostkeycheck
  SSH timeout 5
  SSH group dh-Group1-sha1 key exchange
  Console timeout 0

  dhcpd address 192.168.1.50 - 192.168.1.100 inside
  dhcpd allow inside
  !
  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  WebVPN
  AnyConnect essentials
  internal GroupPolicy_172.xxx.xx.4 group strategy
  attributes of Group Policy GroupPolicy_172.xxx.xx.4
  L2TP ipsec VPN-tunnel-Protocol ikev1, ikev2
  username admin privilege 15 encrypted password f3UhLvUj1QsXsuK7
  tunnel-group 172.xxx.xx.4 type ipsec-l2l
  tunnel-group 172.xxx.xx.4 General-attributes
  Group - default policy - GroupPolicy_172.xxx.xx.4
  172.xxx.XX.4 group of tunnel ipsec-attributes
  IKEv1 pre-shared-key *.
  remote control-IKEv2 pre-shared-key authentication *.
  pre-shared-key authentication local IKEv2 *.
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  maximum message length automatic of customer
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the rsh
  inspect the rtsp
  inspect esmtp
  inspect sqlnet
  inspect the skinny
  inspect sunrpc
  inspect xdmcp
  inspect the sip
  inspect the netbios
  inspect the tftp
  Review the ip options
  inspect the icmp
  inspect the icmp error
  inspect the http

  For IKEv2 configuration: (example config, you can change to encryption, group,...)

  -You must add the declaration of exemption nat (see previous answer).

  -set your encryption domain ACLs:

  access-list-TRAFFIC IPSEC allowed extended LOCAL REMOTE - LAN LAN ip

  -Set the Phase 1:

  Crypto ikev2 allow outside
  IKEv2 crypto policy 10
  3des encryption
  the sha md5 integrity
  Group 5
  FRP sha
  second life 86400

  -Set the Phase 2:

  Crypto ipsec ikev2 ipsec IKEV2-PROPOSAL
  Esp aes encryption protocol
  Esp integrity sha-1 protocol

  -set the Group of tunnel

  tunnel-group REMOTE-PUBLIC-IP type ipsec-l2l
  REMOTE-PUBLIC-IP tunnel-group ipsec-attributes
  IKEv2 authentication remote pre-shared-key cisco123

  
  IKEv2 authentication local pre-shared-key cisco123

  -Define the encryption card

  address for correspondence CRYPTOMAP 10 - TRAFFIC IPSEC crypto map
  card crypto CRYPTOMAP 10 peer set REMOTE-PUBLIC-IP
  card crypto CRYPTOMAP 10 set ipsec ikev2-IKEV2-PROPOSAL
  CRYPTOMAP interface card crypto outside
  crypto isakmp identity address

  On your config, you have all these commands but on your VPN config, you mix ikev1 and ikev2. You have also defined political different ikev2. Just do a bit of cleaning and reached agreement on a 1 strategy for the two site (encryption, hash,...)

  Thank you

• VLAN between two hosts ESXi

  Hello

  I have two virtual machines based on VMware and some configuration of VLAN

  VM1 - VLAN 130 on ESXi01

  VM2 - VLAN 135 on ESXi02

  For example, a machine of vlan ESX1 130 cannot ping a VM one another in the vlan ESX2 130. But if I move the ESX1 second VM, it works.

  VM1 im going through vSwitch 130 VLAN via the ESXi01, what's happening than ESXi via vmnic11 port Vethernet910 on FABRIC

  FABRIC-001-B # connect nxos
  Operating system (NX - OS) Cisco Nexus software
  TAC support: http://www.cisco.com/tac
  Copyright (c) 2002-2014, Cisco Systems, Inc. All rights reserved.
  The copyright in certain works contained in this software are
  owned by others and used and distributed under
  license. Some components of this software are licensed
  the GNU Public License (GPL) version 2.0 or GNU
  Lesser General Public License (LGPL) Version 2.1. A copy of each
  This license is available at
  http://www.opensource.org/licenses/GPL-2.0.php and
  http://www.opensource.org/licenses/LGPL-2.1.php
  Fabric-001-B (nxos) # sh ver

  Operating system (NX - OS) Cisco Nexus software
  TAC support: http://www.cisco.com/tac
  Documents: http://www.cisco.com/en/US/products/ps9372/tsd_products_support_series_h...
  Copyright (c) 2002-2014, Cisco Systems, Inc. All rights reserved.
  The copyright in certain works contained in this document are the property of
  other third parties and are used and distributed under license.
  Portions of this software are covered by the GNU Public
  License. A copy of the license is available at
  http://www.gnu.org/licenses/gpl.html.

  Software
  BIOS: version 3.6.0
  Charger: version N/A
  Kickstart: version 5.2 (3) N2(2.21c)
  system: version 5.2 (3) N2(2.21c)
  power-seq: Module 1: version v2.0
  Module 2: version v1.0
  Module 3: version v2.0
  uC: version v1.2.0.1
  SFP UC: Module 1: v1.1.0.0
  Compile of the BIOS time: 09/05/2012
  kickstart image file is: bootflash:///installables/switch/ucs-6100-k9-kickstart.5.2.3.N2.2.21c.bin
  Kickstart compile time: 05/02/2014 11:00 [05/02/2014 19:47:41]
  filesystem image is: bootflash:///installables/switch/ucs-6100-k9-system.5.2.3.N2.2.21c.bin
  compile time: 05/02/2014 11:00 [05/02/2014 21:42:39]

  Material
  Cisco UCS 6248 series fabric of interconnection ("O2 32X10GE/Modular universal platform supervisor")
  Intel Xeon CPU with 16553964 k of memory.
  Processor Board ID

  Device name: FABRIC-001-B
  bootflash: 31266648 kB

  The availability of the core is 147 day (s), 15 hour (s), 15 minute (s), 46 second (s)

  Last reset
  Reason: unknown
  The system version: 5.2 (3) N2(2.21c)
  Service:

  plugin
  Core Plugin Ethernet, Fc Plugin, Plugin, Plugin of virtualization
  Fabric-001-B (nxos) #.

  on NXOS, I see

  See the fabric-001-B (nxos) # run interface vethernet 910

  interface Vethernet910
  Description 1/3 Server, VNIC VNIC9
  switchport mode trunk
  switchport trunk allowed vlan 1 108-109 115-119 150 - 151
  pinning Server sticking border-interface port-channel13
  pinning of pinning-down server drop down link
  queues of default entry - type service-policy policy
  bind the interface port-channel1282 910 road
  no downtime

  and information portchannel

  Fabric-001-B (nxos) # sh port-channel summary
  Flags: D - low P - Up in the port-channel (members)
  I - individual H - standby (LACP only)
  s suspended r - Module-removal
  S - Dial R - routed
  U - up (port-channel)
  M not in use. Min-links not met
  --------------------------------------------------------------------------------
  Group-Type Port Protocol Ports members
  Channel
  --------------------------------------------------------------------------------
  11 Po11 (SU) Eth LACP Eth1/15 (P) Eth1/16 (P) Eth1/31 (P) Eth1/32 (P)
  13 Po13 (SU) Eth LACP Eth1/14 (P) Eth1/30 (P)
  1280 Po1280 (SU) Eth NO Eth1/1/13 (P) 1/Eth1/14 (P) 1/Eth1/15 (P) 1/Eth1/16 (P)
  1281 Po1281 (SU) Eth NO Eth1/1/1 (P) Eth1/1/3 (P)
  1282 Po1282 (SU) Eth NO Eth1/1/9 (P) Eth1/1/11 (P)
  1283 Po1283 (SU) Eth NO Eth1/1/5 (P) Eth1/1/7 (P)
  1284 Po1284 (SU) Eth NO Eth2/1/1 (P) Eth2/1/3 (P)
  1285 Po1285 (SU) Eth NO Eth3/1/1 (P) Eth3/1/3 (P)
  1286 Po1286 (SU) Eth NO Eth3/1/5 (P) Eth3/1/7 (P)
  1287 Po1287 (SU) Eth NO Eth3: 1/9 (P) Eth3/1/11 (P)
  1288 Po1288 (SU) Eth NO Eth3/1/13 (P) Eth3/1/14 (P) Eth3/1/15 (P) Eth3/1/16 (P)
  1289 Po1289 (SU) Eth NO Eth4/1/1 (P) Eth4/1/3 (P)
  1300 Po1300 (SU) Eth NO Eth1/1/17 (P) Eth1/1/19 (P)

  I have lack of VLAN, how can I edit and update the information of vlan?

  Of UCS Manager? I don't have 1000v.

  Hello

  To add VLANs, you must go to the LAN tab, create them and after that, add them to the vNIC of blades you want to pass traffic for that/those support VLAN.

  You have configured a VLAN in UCSM native?

  The two, ESXi01 ESXi02 & use the same fabric for interconnection to pass traffic?  If a host goes through A traffic and the other through B, traffic will need to visit the switch upstream as cause of tissue switches do not switch traffic between them.

  Try the commands below and paste it here:

  * show circuit of service X Server profile / Y< chassis/server="" in="">

  * Connect nxos one | b< first="" try="" "a"="" then="" "b"="" and="" the="" output="" of="" the="" below="" command="" for="">

  * sh pinning border-interfaces

  * See the platform flexible NHS inter vlandb of info id #.< "#"meaning="" the="" vlan="">

  -Kenny

• Disable SSH on Cisco routers/switches CBC encryption

  Hello

  Our customer ordered PenTest, and as a feedback, they got recommendation "disable SSH Mode CBC Ciphers, and don't allow that CTR ciphers ' and 'Disable weak SSH MD5 and algorithms MAC 96 bits' on their switches Cisco 4506-E with CIsco IOS 15.0

  I went through Cisco documentation that I could find, also tried to find commands on the switch itself, but I found no way to manipulate these SSH options. (SSH v2 only is already set up)

  Is it possible to do this on Cisco IOS? If this is not the case, what are my options?

  You can use an external server for authentication. But that will not change anything in the encryption.

  RAY will be fine for authentication, if you are also looking strong authorization, you should look into GANYMEDE +.

  Back to you initial problem:

  Some long time there was a similar problem with a client and it resolved in the following way:

  1. All routers and switches had a class of only two Linux servers access to access devices through SSH.
  2. The SSH server was accessed by admins and used as a jumping point to access the routers/switches
  3. Linux servers had a put to update the ssh-server config to allow only the strong crypto to Admins and also check the administrative work.

  With this, there was strong crypto by the admin-workstations to linux server and pretty weak crypto of the Linux for routers switches (which was at the time-3900XL-2950). But as the linux-boxes have been placed in the management network, all on the risk has been reduced.

• Implemented two VLANs on two 2748 switches

  I'm trying to set up two new switches 2748 to replace four older switches.  The former hardware connected two subnets with no routing between them, even if some servers are multi-homed.

  On the new 2748 s (appointed 2748A and B 2748), I would like to configure half of the ports on each button for employment on each subnet.  I created a second LAN on each switch and configured VIRTUAL port membership so that VLAN1 contains 1 to 24 ports and VLAN is comprised of ports 25-48.  All traffic is unlabeled.

  2748 switch is connected to our Cisco ASA on port 1 (subnet A) and our SonicWall on port 25 (subnet B).  24 port is then connected to the 24 2748B switch port, and everything works as expected.  However, when I connect 48 2748A switch port to the 48 2748B, all the stops communication LAN port and the switch lights will blink.

  So I guess I'm create a loop that is flooding the network, but I'm not sure of the best configuration to replace the one preceding. Should I configure a single port on the two switches in order to be a member of the VLAN1 and VLAN2 and use it to connect to 2748 A and 2748 B?  If so, who should have the traffic for one or the other tag, or the port is a trunk?

  Thank you for the pointers. I'm trying to understand it on my own, but I do not know where to start...

  
  

• Backdoor in Cisco routers and firewalls.

  The more I read on the NSA scandal (and Yes, I apparently a scandal) less I trust corporations hardware and software.  There is no reason for anyone to doubt that all Cisco equipment comes with a backdoor.  Because these probable backdoors exist it's a matter of time before hackers discover and exploit them.  It's happened to Microsoft a number of times and there is no reason that it could not happen to Cisco.  It is no longer our trust Cisco equipment and have already started researching alternatives network.

  It is more a crazy conspiracy theory, that is the reality.

  In all liklihood, we use a series of firewall to further isolate our network against intrusions.  To reduce costs, we can keep our existing in this topology Cisco equipment, but we will replace hardware Cisco when it breaks down or needs to be upgraded.  I do the same thing with my home network.

  In the last months, we already moved all of our e-mail to secure servers overseas and changed all our McAfee, AVG and Avast antivirus software.  We are also researching Linux distributions to replace Microsoft.

  If Cisco wants to protect their brand, they need to take a stand or see their market share continue to erode.  There must be a CEO to a U.S. company that will take this position and be a hero rather that continue to be a lap dog.

  Hello

  use open-source based linux firewalls and routers.

  and check the source cod