Running Remote Access VPN and DMVPN on the same router

Question:

we're having an issue with Cisco 3560V2 Price a few of our routers that mobile users use to remote access VPN into. These routers are also DMVPN spokes.

Basically I have two isakmp policies and ipsec policies as below:

crypto isakmp policy 3

encr 3des

authentication pre-share

group 2

!

crypto isakmp policy 10

encr 3des

hash md5

authentication pre-share

group 5

!

crypto isakmp key ABC address 0.0.0.0 0.0.0.0 no-xauth

crypto isakmp keepalive 30 5 periodic

!

crypto ipsec transform-set myset esp-3des esp-sha-hmac

crypto ipsec transform-set TS1 esp-3des esp-md5-hmac

mode transport

!

Until this morning, all of the spoke routers on DMVPN were having major issues where they would try to talk to one another but fail due to CONF_XAUTH error. Once I added the no-xauth keyword at the end of crypto isakmp key, all started working well without any issues. However since then, our remote access VPN clients are no longer working. If I remove no-xauth, remote access clients start working but DMVPN starts to flap.

Any ideas?

Answer:

I think you can use isakmp profiles to split the keyring for the remote access and the one that is Cisco 3560V2 for dmvpn

http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6635/prod_white_paper0900aecd8034bd59.html

IP SLA Not Recovering

Question:

This is driving me crazy.WS-C3560X-24P-S IP SLA works for failing over to the secondary connection (from Cable to DSL), however the SLA can never reach 4.2.2.2 from the cable, even when it is up. I can ping the interface from the outside world and get responses, but the SLA still thinks the connection is down. I think it has something to do with the NAT, but I seem to be spinning my wheels.

On the SLA, when the source isn't specified, it toggles up/down - I'm assuming because it's going out the backup connection, then the SLA comes up thinking all is well, realizes its down, and jumps back. When I specify source IP (or interface), it stops doing this, but never recovers from the failover.

Reloading the router causes it to switch back to the cable and all is well again until the cable drops and comes back up.

I'm 99% sure that I've overlooked something quite elementry, I just can't think of it.

Answer:

Besides possible additional connection problems the up-/down-flapping of the IP-sla is the expected behaviour with your design in case of a primary link failure.

The route selection for icmp sla packets is based soley on the routing table, not the source interface. If track 1 goes down, your ip sla is using the remaining route. Assuming the backup link is working properly, the IP sla is successfull again and track 1 comes up. Now IP sla is using the 68.x.x.201 route again, although the primary link is still down, so ip sla goes down and here we go...

Your backup link is not going to work this way. You need to make sure the icmp sla always uses the primary way no matter wether the primary route is installed in the routing table. One way would be to use

ip local policy route-map

matching on icmp and the source interface ip.

The only question left, is how to get the backup WAN interface (FA0/2/0) to respond to pings from the internet. I'm assuming this will require a similar local route map, but I'm not too sure how to swing that without conflicting with the new addition above ..

Just refine your ACL:

access-list 129 permit icmp 68.x.x.204 4.2.2.2

Now it is only applied for this specific router WS-C3560X-48P-L Price generated traffic.

Problem upgrading C2960 IOS via TFTP

Question:

I got my new C2960 a couple Catalyst 3560 Price of days ago with an outdated IOS version (12.2) and i wanted to test the new IOS (15).

I know i can delete the current IOS version and download the new one from tftp server but i just want to test the new IOS without deleting anything yet. Once i like it, i will put it in the flash.

So, i created a tftp server, tested it,  and it worked fine. I even copied the running-config file from the flash to my computer using tftp server with no problems. So, tftp server and its connection are working fine.

Now, i tried

Switch(config)#boot system tftp://192.168.4.17/c2960-lanbasek9-mz.150-2.SE4.bin

This command should boot the switch using the IOS in the tftp server which resides in my computer (192.168.40.17) the next time i reload the switch. I saved my config and i rebooted the router.

This is what i got when reloading...

Loading "tftp://192.168.4.17/c2960-lanbasek9-mz.150-2.SE4.bin"...tftp://192.168.4.17/c2960-lanbasek9-mz.150-2.SE4.bin: no such device

Error loading "tftp://192.168.4.17/c2960-lanbasek9-mz.150-2.SE4.bin"

When i think of it, how can the switch access my computer's ip address during booting process? In booting process all the ports are showndown for failure testing purposes.

Am i using the wrong command to achieve what i want?

Answer:

TFTP boot don't work all the time.

Don't even bother trying Catalyst 3560V2 Price  to do this.

Why BGP can not accessible internationally?

Question:

I have recently setup Catalyst Switches a router and found that i can access any website in my country also my IP block is pingable from my country
but i can not access any site which is outside of my country and i can not ping also. i am very new in routing can you someone tell me where is the problem.

Answer:

checking from a public router, it doesn't reach your IP.

ask your upstream peer, Mega Host Zone India, to advertise your routes out to the internet.

route-views>tr 103.16.100.1

Type escape sequence to abort.
Tracing the route to 103.16.100.1

  1 vl-51.uonet1-gw.uoregon.edu (128.223.51.2) [AS 3582] 236 msec 296 msec 244 msec
  2 vl-3.uonet9-gw.uoregon.edu (128.223.3.9) [AS 3582] 244 msec
    vl-2.uonet9-gw.uoregon.edu (128.223.2.9) [AS 3582] 244 msec 236 msec
  3  *  *  *
  4  *  *  *
  5  *  *  *
  6  *  *  *
  7  *  *  *

route-views>sh ip ro 103.16.100.1
% Subnet not in table

route-views>sh ip bgp 103.16.100.1
BGP routing table entry for 0.0.0.0/0, version 458090
Paths: (1 available, best #1, table Default-IP-Routing-Table, RIB-failure(17))
  Not advertised to any peer
  19214 12989 2828
    208.74.64.40 from 208.74.64.40 (208.74.64.40)
      Origin IGP, localpref 100, valid, external, best


% Whois data copyright terms    http://www.apnic.net/db/dbcopyright.html

inetnum:        103.16.100.0 - 103.16.100.255
netname:        MEGAHOSTZONE-IN
descr:          MegaHostZone Pvt. Ltd.
country:        IN
admin-c:        SR552-AP
tech-c:         CEO6-AP
mnt-by:         MAINT-IN-IRINN
mnt-routes:     MAINT-IN-MEGAHOSTZONE
mnt-irt:        IRT-IN-MEGAHOSTZONE
status:         ASSIGNED PORTABLE
changed:        hm-changed@apnic.net 20130205
source:         APNIC  Cisco 3560 Price

Need to use both links at same time for site-to-site vpn

Question:

i'm having some cofussion WS-C3750X-12S-S Price that i have 2 internet connections and i want to use them as ACTIVE & STANDBY or both can load share at the same time with site to site vpn configuration  

if i configure gateway of vlans on multilayer switch then how can i configure HSRP or if i do PBR then how it can be???????????             

     

Devices:

cisco 881 router with 5mbps link

cisco 837 router with 2mbps link

cisco 3560x multilayer switch

Answer:

Here is simple config for VPN backup on Head office:

crypto ipsec transform-set XX esp-3des esp-sha-hmac

crypto map MAP-A 100 ipsec-isakmp

set peer 2.2.2.2

set peer 1.1.1.1

set transform-set XX

match address vpn-to-branch

And on Branch you could configure HSRP on routers for failover.

Hope it WS-C3750V2-48PS-S will help.

VRF - Exporting and Importing

Question:

I’m working with MP-BGP.Cisco 3560X  I am trying to import and export routes to and from 3 vrf's within the same Cisco 4948 switch.

Essentially i have 3 vrf's : UAT-VRF , GLOBAL-VRF and INFRA-VRF

Route leaking is configured between the following: UAT-VRF-> GLOBAL-VRF <-INFRA-VRF

I also have filter lists which permit certain routes into UAT and INFRA.

ip vrf INFRA-VRF

rd 65201:3

import IPv4 Unicast map INFRA-VRF-IMPORT

route-target export 65201:3

route-target import 65201:1

route-target import 65201:3

!

ip vrf GLOBAL-VRF

rd 65201:1

route-target export 65201:1

route-target import 65201:3

route-target import 65201:1

route-target import 65201:6

!

ip vrf UAT-VRF

rd 65201:6

import IPv4 Unicast map UAT-VRF-IMPORT

route-target export 65201:6

route-target import 65201:6

route-target import 65201:1

!

Note - the import filters are based around prefix lists which do match the exact route's required.

interface Vlan1130

ip vrf forwarding UAT-VRF

ip address 10.11.130.253 255.255.255.0

standby 130 ip 10.11.130.254

standby 130 priority 150

standby 130 preempt

standby 130 authentication md5 key-string

interface Vlan1067

ip vrf forwarding INFRA-VRF

ip address 10.11.67.253 255.255.255.0

standby 67 ip 10.11.67.254

standby 67 priority 150

standby 67 preempt

standby 67 authentication md5 key-string

interface Vlan2508

ip vrf forwarding GLOBAL-VRF

ip address 10.31.8.253 255.255.255.0

standby 8 ip 10.31.8.254

standby 8 priority 150

standby 8 preempt

standby 8 authentication md5 key-string

router bgp 65201

address-family ipv4 vrf UAT-VRF

  redistribute connected

no synchronization

exit-address-family

address-family ipv4 vrf GLOBAL-VRF

  neighbor 10.31.8.252 remote-as 65201

  neighbor 10.31.8.252 activate

  neighbor 10.31.8.252 send-community both

  no synchronization

exit-address-family

address-family ipv4 vrf INFRA-VRF

  redistribute connected

  no synchronization

exit-address-family

!

Network 10.11.130.0/24 originated in BGP from the UAT VRF (UAT-VRF) with a redistribute connected (as shown above in the BGP configuration). As you can see below the GLOBAL-VRF VRF has the imported route successfully. Now we need to leak the best route out into the INFRA-VRF VRF.

SWITCH#sh ip bgp vpnv4 vrf GLOBAL-VRF 10.11.130.0

BGP routing table entry for 65201:1:10.11.130.0/24, version 1485372

Paths: (2 available, best #2, table GLOBAL-VRF)

Advertised to update-groups:

     1         2         3         4

Local

   10.31.8.252 from 10.31.8.252 (10.21.101.248)

     Origin incomplete, metric 0, localpref 100, valid, internal

     Extended Community: RT:65201:1

Local, imported path from 65201:6:10.11.130.0/24, imported path from 65201:6:10.11.130.0/24

   0.0.0.0 from 0.0.0.0 (10.21.101.249)

     Origin incomplete, metric 0, localpref 100, weight 32768, valid, external, best

     Extended Community: RT:65201:6

     mpls labels in/out nolabel/nolabel(GLOBAL-VRF)

Is this technically possible? Or is this not working as expected due to a loop prevention mechanism?

It seems we cannot export an already imported prefix.

Any comments would be appreciated.

Answer:

I think its not possible because by the command route-target export you are only exporting the routes which are locally originated.

Not the one whicha re imported from other vrfs. If it is possible with otut leaking the rt at the needed vrf, Catalyst 3560 Price then it can be a security issue also...

Interlink between the two backbone switchs

Question:

We are operating the two backbone Cisco 3560 switchs for redundancy with hsrp and eigrp.

I am wondering if I connect the two links (trunk and L3) or just one port (trunk or L3) between the backnone switch.

I attached the diagram that simply indicates the my concers.

In this case, what would be the best option ?

Please give me a recommendation.

Answer:

both HSRP and EIGRP requires L2 adjacencies so you need a L2 trunk on all the involved Vlans between the two switches.

If you like you can add a separate L3 link between the two as an added protection.

The minimum is a L2 trunk, you should consider the use of an etherchannel bundle with two member links configured as 802.1Q L2 trunk. In this case I recommend the use of LACP ( mode active) for better resiliency ( bundle only if LACP messages are exchanged on Cisco 3560V2 Price each member link)