Tag Info

New answers tagged

1

The solution only partly solves the problem, becuase I did not mention that we use NAT. So, NBAR inspects all inbound packets through service-policy on outside interface, and assigns DSCP bits to them. Now, the problem is to get these packets NAT-translated for internal ips. Schematically i need something like this: nat inside source static tcp ...


1

No, the Cisco ASA 5505 only provides 100Mbps interface ports. I would suggest purchasing a dedicated Gigabit switch rather than relying on your firewall's interfaces.


0

I figured it out. Turns out to have been just a coincidence that tables weren't responding. As far as I can see, no IPSec policy or tunnel information is available via SNMP until the tunnel is active, aka traffic has been sent through it. This explains why I wasn't getting any response from the OIDs I cared about even though I'd added policies, I simply ...


0

Is that OID 1.3.6.1.4.1.9.9.171.1.3.3.1.4 (means cipSecEndPtLocalAddr1) in your mib? (/usr/share/snmp/mibs/CISCO-IPSEC-FLOW-MONITOR-MIB.txt on my servers) How does it precisely behave? Could you paste your snmpget with output and snmpget version?


0

I would use the openconnect cisco vpn client. http://www.humans-enabled.com/2011/06/how-to-connect-ubuntu-linux-to-cisco.html


0

Here are some good resources where you can download cisco vpn client for linux: cisco vpn We've been using them without no problem in Fedora 13 and kernel 2.6.x. how-to But be careful because as the other mate said, cisco is dropping cisco-vpn-client.


0

You can use the Open Source Client vpnc. It's a RPM Package. I used this Client for many years on my Debian. Today most people use Cisco Anyconnect for VPN Dialin because the VPN Client is going End-of-Life by July,24 2014. http://www.cisco.com/c/en/us/products/collateral/security/vpn-client/end_of_life_c51-680819.html


1

If your MIB is not available in your equipment, you can't ask him the informations. After that, check if the OID is availble (if you know it) : sometimes the constructor sites are wrong, and you have access to some OIDs but the MIB is not in the available list. Of course, the OIDs is not customizable : it is programmed in hard in the equipment. The MIB ...


0

Problem I actually used to support these routers a few years ago working for Cisco. Your main problem lies in that the WRVS4400N only supports site to site IPSEC tunnels. Windows VPN and port 1723 is PPTP, which is completely different. WRVS4400N and other small business class routers (specifically the rebranded Linksys routers) only support client-to-site ...


0

You can apply a management access rule to the control plan of the asa and effectively permit/deny specific source addresses from accessing the webvpn address. Please reference the following: http://www.cisco.com/c/en/us/td/docs/security/asa/asa83/asdm63/configuration_guide/config/access_management.html


1

An ASA will do everything the PIX did and then some, so it the replacement. You can pretty much drop a PIX config onto an ASA and it will run, so there's no way I'd buy a PIX today.


2

It depends what you want to do. PIX is still good.515e and 535 even the old 506e . As I said before it depends on your requirements of design.I still use and deploy them. Configure them good and they are solid. Devices and age ,old or new is not the problem. It is the person configuring them and whether it supports what you want to do. People think ...


1

Sub-interfaces allow for things like split-horizon or multicast reverse path forwarding to work without special configuration. If you only used the one interface then split-horizon would kick in and not send updates from A to B to C (if you have a hub and spoke) also multicast packets coming from A to B would not go back out to C due to it being the ...


1

port 5060 is only for setting up the call. All the actual voice traffic is on a range of ports which varies. You need to setup port based QOS for the port your SIP devices are connected on.


1

For future reference, I think the option you are looking for may be 'Unregistered Multicast' filtering on the SG300s. (I tried the previous answer's suggestion but that wasn't enough to help in itself for me) I just had a Meraki router which was for some reason, subscribing to our Symantec Ghost Multicast sessions, not ideal! Setting Unregistered Multicast ...


0

I think what you want is to do application layer inspection and alter it to include other ports. http://www.cisco.com/c/en/us/td/docs/security/asa/asa72/configuration/guide/conf_gd/inspect.html


0

I would add a comment but I cannot. The answer is to simply add an allow statement for your DNS servers that you use so if you're using Google's 8.8.8.8 then add a permit statement for udp port 53 from 8.8.8.8 above your deny statement. OR use reflexive ACLs: http://www.cisco.com/c/en/us/td/docs/ios/12_2/security/configuration/guide/fsecur_c/scfreflx.html


1

I've seen issues on multiple 881's I've deployed with doing the nat overload and using the Interface. For the most part making the wan link a static IP and changing the IP nat overload command to that has fixed most of the issues with calls and even phones freezing. Good luck



Top 50 recent answers are included