Tag Info

New answers tagged

0

I had the same issue on the following hardware: M1000 Blade Chassis Dell MXL Force10 switch The solution was to decrease the ARP table refresh rate on the Dell MXL Foce10 switch by issuing this command: mac-address-table station-move refresh-arp


0

You probably should look into port security topic here: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3560/software/release/12-2_52_se/configuration/guide/3560scg/swtrafc.html#wp1038501 Idea is that you can assign list of legit MAC addresses that are able to connect given port number without security warning.


0

This problem has been solved, There is a subtle incompatibility with the kboot image and the full IOS image. Simply add a boot bootldr bootflash:ignore statement to your config (must be done in an editor if you dont want the hassle of creating a virtual file) then only have one IOS image in flash, the full image. The router boots and works as expected with a ...


0

To return all access point settings to the factory defaults including password you need to use the MODE button. Disconnect the power and press and hold the MODE button while you reconnect power to the access point. You need to hold the MODE button until the ethernet LED turns amber (approximately 2 to 3 seconds), then release the button. Then you can ...


-3

is it in different loactions ! i assume that your SP should provie to you a specific vlan and associate a techonlogy called "qnq tunnel" that mapping to your multiple VLAN on your both DC to one Vlan on SP.


0

It sounds like 10.10.9.1, the gateway of your "external" VLAN, is the VLAN interface of the Cisco 3560. This managed switch is doing some Layer 3 routing alongside Layer 2 switching. If you can get into the elevated prompt of the Cisco command line, you should: Get the list of interface names, to be used in later commands: show interfaces brief Ensure ...


2

ip address 10.10.0.1 255.255.255.0 Your router will not be able to reply to the data it's being sent, because it itself is restricted to the original /24. Change this to ip address 10.10.0.1 255.255.252.0


0

Given the layout provided, no, the Cisco ASA/IPS can't detect any Internet-based attacks on the Fortigate because it can't see the traffic on that interface. That said, gowenfawr is right about the IPS seeing bi-directional traffic, though only on interfaces connected to the IPS. Depending on an number of factors, you could mirror the Fortigate <-> ...


0

I'm not sure it actually has anything to do with Federation. We aren't federated, and after the Mar 10th signature update it began blocking our on-prem Outlook clients from downloading images and RSS feeds. Ironport appears to be filtering on the UserAgent, which does include the text Microsoft Outlook, and then blocking based on the Webmail (Outlook.com) ...


0

I'm not sure if I'd call it a 'native' functionality, but its not an uncommon thing to do. The basic mechanism by which you would accomplish this type of authentication is to use machine certificates. By leveraging your active directory as a PKI environment, you can deploy machine certificates to every Windows machine. Once you have deployed machine ...


1

You may find port 25 is a management port so may only allow traffic from itself. You can plug the router into any port so try that first. Alternatively you may have VLANS setup incorrectly especially if you use IP phones. If this is the case you will need to setup the Blue ports to be trunk ports.


1

There is a similar report on the Zabbix bug tracker at ZBX-8681, which was closed as a duplicate of ZBX-7190. You might wish to add additional information (hardware, tcpdump, Zabbix log) to the latter issue.


0

Are you using option 66 and 67 together? What did you fill in in option 67? Have you filled in this in option 67 SMSBoot\x64\wdsnbp.com In option 66 should be the IP of the SCCM server


1

Allow error messages at a minimum. If you block error messages you'll cause timeouts because a system keeps waiting for something that will never happen and it won't know about that because the error message that would have told it that was blocked. Things like redirects can usually be blocked, but depending on your network architecture it might cause less ...


0

Radius is only used as an an authentication protocol with Cisco when matching against user accounts. TACACS+ is the full AAA protocol suite. Further more, if want to accounting of the commands that a user is sending to the Cisco device your will need setup a tacacs+ server.


2

In your situation I would simply use the ASA as a DHCP that hands out its internal IP as the DNS server, use DNS proxy to the tunnel DNS and have several public DNS's listed in the config. EG. (these commands work on c3900 equipment ios15.1, you may have to make changes to be compatible to the ASA software) service dhcp ip domain nameserver "tunnel dns" ip ...


1

I'm not an STP expert, but I'll take a crack at this. The brief loss of connectivity sounds like the expected behavior to me, based on what happens during an STP topology change. When the STP topology changes (due to a switch port transitioning to or from the blocking or forwarding state, because a switch or uplink is added, removed or fails), some frames ...


0

So issue turned out to be the access control lists trying to apply NAT rather than routing to the VPN. Using ip access-list extended NATList deny ip 10.87.189.0 0.0.0.255 172.31.0.0 0.0.255.255 log permit ip 10.87.189.0 0.0.0.255 any log ip access-list extended cryptoacl permit ip host 10.87.189.36 host 172.31.2.33 fixed it.


2

If you want it to learn a new MAC and make it sticky you'll to remove the old one: no switchport port-security mac-address mac_address in the relevant interface. The docs here have some useful info but you might want to consult the docs your specific IOS version.



Top 50 recent answers are included