Hot answers tagged

12

You need to find a Cisco serial cable if you just did a wr erase. The next time this router boots, it will have no interface or password configuration on it, which means you're stuck with no access to it unless you log back on and do a wr mem to save the running configuration to nvram. A factory reset requires a console connection because this erases the ...


10

The problem wound up being a corrupted cookie in rommon... Cisco IOS uses a hidden cookie value to derive the mac-address and serial number for the chassis. If the cookie is corruped, IOS cannot finish loading... all ff values below is obviously corrupted. This site has more information about how the rommon cookie works; however, Cisco TAC says that ...


9

One thing to try: router(config)#no logging console no logging console will disable the output of the debug message on the serial console. As the console is interrupt-driven, each character is an interrupt.


9

Have you looked at the Cisco troubleshooting guide for high cpu ? It has an extensive guide on what to do when encountering high CPU loads. Included are : Determining Causes and Solving the Problem : High CPU Utilization due to Interrupts High CPU when Enabling Netflow NDE on Cisco 7600 Series Router High CPU Utilization due to Processes PCI and FAST ...


9

The management-access command is a bit of a misnomer - it doesn't dictate which interface can receive management traffic. Management traffic (which interfaces it listens on, and which addresses are allowed) is controlled by the http and ssh commands (telnet too, but leave it off!): http server enable http 10.0.0.0 255.0.0.0 inside ssh version 2 ssh 10.0.0....


9

Google tells me "No, mostly." https://docs.meraki.com/display/SM/Systems+Manager+FAQ#SystemsManagerFAQ- Does the user have to enter the Apple ID password for every app installed? When Apps are deployed via MDM, Apple requires an Apple ID and password for the app to be installed. Apps downloaded and installed via Apple Configurator do not ...


8

What are the errors in the log from 10:06:40.691 to 10:06:40.723? Line 10:06:40.691 5 SMTPI-011473([69.197.220.11]) inp: \022\003\001 was part of SSL handshake. Byte 0 = 022 means SSL record type = 22 (SSL3_RT_HANDSHAKE) Byte 1-2 = 0301 was means SSL version = TLS1_VERSION See this page for reference. But unfortunately the server on port 587 doesn't ...


6

As of 2011.11.28 the accepted answer, while correct in some cases, is not accurate in others. The ASA uses a slightly different model than traditional IOS routers and this where some of the confusion sits. The second piece is whether or not aaa authentication enable console LOCAL is configured. Scenario 1 - Enable Authentication Not Configured Relevant ...


6

Thanks to a nice sock in chat, I found the answer to this after I'd already typed up the question. The painfully obvious answer is show interfaces. Good ol' shint. Hopless-WAP#sh int [...] Dot11Radio0 is up, line protocol is up Hardware is 802.11G Radio, address is feed.face.beef (bia beef.face.feed) MTU 1500 bytes, BW 54000 Kbit, ...


6

I think what you are looking for is : router# show running-config interface FastEthernet0/1 This will only display the configuration for port Fa0/1. When you are in config mode, you can use the do keyword to call the show command : router(config)# do show running-config interface FastEthernet0/1


6

For example, let's say I own a domain example.com, I'd like to create a subdomain mypc.example.com (not just only one though) that is only resolved for those phones (Android/iOS) and PCs (Windows, Linux) that have a specific key, those machines who do not have that key mustn't be able to resolve the IP. Basically a private replacement to dynamic DNS services....


5

As with the loopback interface on your PC, loopback interfaces on Cisco devices are local to those devices only. In order to reach the loopback IP, you must have some route to it via the Cisco device in question. In your example, you would need to give the router an address on Fa0/1 and put the PC in the same subnet (not the same subnet as the loopback ...


5

Unfortunately, that is not possible to do on an HP switch, where all port membership is configured as part of the vlan configuration. On the other hand, that is the standard way to do it on a Cisco switch, where a port's config includes all the vlans allowed through it.


5

There isn't really a solution, from a file compression standpoint, that you can use. The router's bootloader decompresses the IOS image and, since you can't alter the bootloader adding support for new compression algorithms isn't possible. Having an out-of-band management connection would the best techncal means to safely handle these situations. In the ...


5

Unfortunately, no, IOS does not support anything like this. The closest feature would be object-groups for ACLs, which were added in 12.4(20)T. They allow you to define an object-group containing the IP address(es) (or TCP/UDP ports or other things) you want to filter on. You would then reference the object-group instead of a static address in your ...


5

The question is old, but it will be found during searching. I spent some time to find solution to the same problem. Thus I decide to write the answer to share my results with others. Short answer: you should not use IIS Crypto to specify the order of Cipher Suites. I recommend you to click on "Defaults" buttons to remove previously set order and then use ...


4

Stick with 12.2(55)! IOS 12.2(58) and higher have major memory leak issues that can lock you out of the switch (console included) and should be used with caution. Details. This bit me in the you know what pretty hard. Although to answer your question - technically yes you could upgrade to 15 if you wanted to.


4

You can login directly in enable mode if your privilege level allows it. I am running asa916-k8.bin on 5510 The command is aaa authorization exec LOCAL auto-enable Ravi L


4

Heres the best way I can explain it: enable password uses no encryption at all, so this is obviously not recommended. enable secret uses MD5 to hash the password, so you do not have to worry about the enable password being stored in clear text. If your cisco device supports it, then use it. service password-encryption encrypts all other passwords such as ...


4

The support is mixed. Some devices support both, some only one and some again, neither (IOS-XR, which is a bit short-sided on their part). It is really up to the business units (sadly). That being said, I find that 90% of the customers and vendors out there still use RFC 3164. RFC 5424 might be considered "better" since it makes events easier to parse on ...


4

You've already discovered that there's two sets of RAM on the 6500/7600 series supervisors - the switch processor or supervisor RAM, and the MSFC or "route processor" RAM. The terminology isn't helped by there being three different names for each of these two components. The "sh ver" output is for the MSFC (RP) (add the two values together). "remote command ...


4

show sessions will display outgoing connections from your switch/router to other devices. show users will display incoming connections to the vty interfaces (ssh/telnet...) of your switch/router. So i think you need show users here.


4

Sure, that info's usually in the output of show version , though that might vary with specific devices and software versions.


4

I recently wrote an Ansible module that allows you to use SSH+SCP to transfer a file to Cisco IOS devices. One of the use cases is obviously transferring IOS images. It has some built-in checks like not transferring the file if it already exists and performing an MD5 comparison (original file to transferred file). The MD5 is CPU intensive on the router, ...


4

Take a look at https://technet.microsoft.com/en-gb/library/hh529949(v=exchg.150).aspx There is an interesting line at the bottom of that page that implies the effective maximum limit is about 33% less then the limit you have configured. Given the default for active sync is 10mb and you are seeing problems around 7, that would make sense. Try increasing to ...


4

To see the areas which your current router is advertising routes for you can run the command sh ip ospf statistics This will show the areas for which SPF algorithm ran and other statistics about the results of that algorithm, Plus this will show for all the ospf processes running on the router. There is no way you can see the areas which were running ...


3

Have a look into IP SLA and policy based routing. You should be able to do what you want with a combination of those.


3

The command is ip nat inside source static <internal address> <public address> for NATing the an entire IP, or ip nat inside source static tcp <internal address> <port> <public address> <port> ip nat inside source static udp <internal address> <port> <public address> <port> For specifc udp or ...


3

I was confused by this as well but it turns out you just have to enter the password twice. user test pass rootbeer priv 15 The user test will login and then when prompted for the enable password the user will enter rootbeer


3

You have an "IPBASEK9" image, but you need "ENTERPRISESERVICES" to use Policy-based routing; you probably want ENTERPRISESERVICESK9, since the original image is a crypto image (K9 suffix). Please see page 2 of this Catalyst 4500 Features at a Glance brochure.


Only top voted, non community-wiki answers of a minimum length are eligible