|
Powercrazy posted:I think I may have even posted them. If not I can post some configs tomorrow. I would greatly appreciate the help. I don't even know where to start, though I am still researching it.
|
#
?
Jul 1, 2010 19:38
|
|
|
|
| # ? May 14, 2024 13:04 |
|
|
Just to clarify you are trying to do site to site vpns right? Because if you are trying to do per user vpns then I'm not sure if they will help you. Hub Site: code:Spoke Site: code:
|
|
#
?
Jul 1, 2010 19:45
|
|
|
One thing is the hub sites, wont be cisco routers, they will be the lovely retail routers like I had mentioned so I really dont think the DMVPN will work for me in this instance... What do you think? EDIT: In fact if we can't go DMVPN that isn't a total loss as we do not change IP's very often at all, if at all for that matter. So, regular VPN would work just fine as well. crypto isakmp policy 1 encr 3des authentication pre-share crypto isakmp key cisco address 0.0.0.0 0.0.0.0 crypto isakmp keepalive 30 5 <--- What does this part mean? crypto isakmp nat keepalive 30 I noticed that this may work for me. Is 'Authentication pre-share' the same as 'Secret' shown on the images on the last page? I assumed it was a pre-share key but I didn't want to outright assume it. What is the 30<space>5 represent? 30 seconds and.... Bardlebee fucked around with this message at 20:28 on Jul 1, 2010 |
|
#
?
Jul 1, 2010 20:23
|
|
|
The 30 indicates that a keepalive or Dead Peer Detection message is sent every 30 seconds. Once a DPD message is missed by the peer, the router moves to a more aggressive state, sending DPD retry messages every 5 seconds. After 5 aggressive DPD retries, the tunnel is marked as down. Its basically the keepalive time for the phase one secure tunnel. And yes I'm pretty sure that Authentication pre-share is identical to (shared) secret in the gui. The major advantage of DMVPN is that it is much more scalable, as each additional site doesn't change the hub configuration. But yea if you have only a few remote sites, then its actually pretty straight forward to add additional tunnels on the hub router. If you aren't using Cisco for the hub then you can't create GRE tunnels, so you won't be able to have routing protocols that use multicast running across them. ate shit on live tv fucked around with this message at 20:45 on Jul 1, 2010 |
|
#
?
Jul 1, 2010 20:42
|
|
|
Powercrazy posted:The 30 indicates that a keepalive or Dead Peer Detection message is sent every 30 seconds. Once a DPD message is missed by the peer, the router moves to a more aggressive state, sending DPD retry messages every 5 seconds. After 5 aggressive DPD retries, the tunnel is marked as down. Yeah, we aren't doing anything elaborate like that. Trust me. This is a business of 100 people, I ain't doin' no fancy dandy Network Engineering stuff beyond this one gem of a router I got my grubby hands on.  Not only that, but we don't even have a domain controller. So it's that simple. We are a medical clinic. I wish I knew the colon sign for that little yellow guy crying... Anyway onward to the subject: Do I need any of this aaa authentication stuff in this link? Also, I hope CCNA2 goes into VPN's, because it would be nice to know what I am doing here. http://www.fredshack.com/docs/vpnios.html
|
|
#
?
Jul 1, 2010 20:54
|
|
|
Bardlebee posted:Anyway onward to the subject: Do I need any of this aaa authentication stuff in this link? Also, I hope CCNA2 goes into VPN's, because it would be nice to know what I am doing here. 16 pages of VPN material in the official ICND2 book so don't look for it to go into VPNs in any serious depth.
|
|
#
?
Jul 1, 2010 20:59
|
|
|
Powercrazy posted:If you aren't using Cisco for the hub then you can't create GRE tunnels, so you won't be able to have routing protocols that use multicast running across them. Just as a side note, ASA's don't support creating GRE tunnels and neither do the 3560 layer 3 switches. Harry Totterbottom fucked around with this message at 21:07 on Jul 1, 2010 |
|
#
?
Jul 1, 2010 21:02
|
|
|
Harry Totterbottom posted:Just as a side note, ASA's done support creating GRE tunnels and neither do the 3560 layer 3 switches. Does this mean my Cisco 1811 can't make VPN tunnels with these random VPN routers?
|
|
#
?
Jul 1, 2010 21:05
|
|
|
Bardlebee posted:Does this mean my Cisco 1811 can't make VPN tunnels with these random VPN routers? It depends on if the random VPN routers can handle terminating a GRE tunnel. Otherwise you might need to look at setting up basic IPSec tunnels between the sites. The main downside I know of (there could be more and someone else please chime in) with IPSec tunnels is that you can't run EIGRP across them without GRE as well. They can handle OSPF in point-to-point, but I don't think they'll do multi-point or broadcast for that either. The ASA's can pass traffic through a gre tunnel from point A to point B, but they can't create or terminate the actual gre tunnel.
|
|
#
?
Jul 1, 2010 21:10
|
|
|
Harry Totterbottom posted:It depends on if the random VPN routers can handle terminating a GRE tunnel. Otherwise you might need to look at setting up basic IPSec tunnels between the sites. The main downside I know of (there could be more and someone else please chime in) with IPSec tunnels is that you can't run EIGRP across them without GRE as well. They can handle OSPF in point-to-point, but I don't think they'll do multi-point or broadcast for that either. As a matter of fact they are using IPsec now, I would not be opposed to keeping it that way. So yes, definitely keeping it on IPsec. Stupid question: Do I need OSPF or a routing protocol for this?
|
|
#
?
Jul 1, 2010 21:25
|
|
|
Harry Totterbottom posted:It depends on if the random VPN routers can handle terminating a GRE tunnel. Otherwise you might need to look at setting up basic IPSec tunnels between the sites. The main downside I know of (there could be more and someone else please chime in) with IPSec tunnels is that you can't run EIGRP across them without GRE as well. They can handle OSPF in point-to-point, but I don't think they'll do multi-point or broadcast for that either. Right. The major thing for GRE is that it allows multicast, and since the common routing protocols (eigrp, ospf, rip) all use multicast for their discovery and routing updates without multicast, those protocols break. For Bardlebee just setup some site-to-site IPSec tunnels, and use static default routes to point unknown traffic to the tunnels, and you should be fine. No you shouldn't need to run any routing protocols as long as the number of sites is low. ate shit on live tv fucked around with this message at 21:29 on Jul 1, 2010 |
|
#
?
Jul 1, 2010 21:26
|
|
|
Powercrazy posted:Right. The major thing for GRE is that it allows multicast, and since the common routing protocols (eigrp, ospf, rip) all use multicast for their discovery and routing updates without multicast, those protocols break. Ok, I am going to post a my attempt to do this and post my config later Thanks for the help guys! EDIT: Ok, can you guys take a look at this and tell me if I did this right? :P I am going off of pure research here, found a nice site that was a step-by-step for IPSEC/VPN The other site local LAN is 192.168.11.0. It's outside IP is 333.333.333.333 The router I am replacing is 192.168.2.0. Also, I don't think I did the following line right since both routers need to be using 3DES: crypto ipsec transform-set esp-aes-sha esp-aes esp-sha-hmac code:Bardlebee fucked around with this message at 22:55 on Jul 1, 2010 |
|
#
?
Jul 1, 2010 21:30
|
|
|
Bardlebee posted:Ok, I am going to post a my attempt to do this and post my config later Also, please change your admin password for that router.
|
|
#
?
Jul 4, 2010 01:55
|
|
|
Moxnight posted:
Heh, of course I will be doing that, thanks for the heads up though. I will be testing this guy out on Tuesday. Thanks!
|
|
#
?
Jul 4, 2010 19:02
|
|
|
I'm not sure where to put this question, but it's the best place I could find since there are basically no other threads close. The place I work at has asked me to do some stuff with VoIP. We primarily use Cisco and Polycom, and I've been asked to look into making it easier to make configuration files for them. From what I've seen, configuration file creation is either poorly documented or my google-fu is weak. I've got various admin manuals, but I was wondering if there was a beginner friendly anything on creating/maintaining configuration files. I've gotten some files working by looking at existing files, but they're incredibly basic and don't do much more than set up a name and register the phone. Any thoughts?
|
|
#
?
Jul 6, 2010 01:19
|
|
|
I hope this question hasn't been answered before: What is the easiest way to get my foot in the door and wrap my head around SNMP and NMS? I've looked into the cisco configuration GUI, that seems to only monitor one thing at a time. I'm willing to step into linux but would prefer windows; my cacti and zabbix installation has been abysmal trying to put all the mysql and php pieces together... it has been a nightmare. Are there any open source NMS that are either a. easy to implement or b. not so easy to implement, but by following non cryptic steps it has worked
|
|
#
?
Jul 7, 2010 08:15
|
|
|
KernelFailure posted:I hope this question hasn't been answered before: What is the easiest way to get my foot in the door and wrap my head around SNMP and NMS? I've looked into the cisco configuration GUI, that seems to only monitor one thing at a time. If you want to skip right to SNMP stuff with fewer dependencies you could just install MRTG and read the cfgmaker docs and setup some simple polling and graphs. This is mostly what I have to create an MRTG config file, if you want more devices just add more lines for community@hostname. The options at the top are some of them that I use, see the cfgmaker docs to add/remove/tweak more. In this example, "/usr/local/www/data/mrtg" is where you would set your web server to serve up graphs. code:code:code:falz fucked around with this message at 19:04 on Jul 7, 2010 |
|
#
?
Jul 7, 2010 15:03
|
|
|
Here is a list of a lot of NMS/SNMP products. I've tried a few of them but I don't really like any of them and we just use Orion where I work anyway. http://www.slac.stanford.edu/xorg/nmtf/nmtf-tools.html#nmp I'm sure you can find something there.
|
|
#
?
Jul 7, 2010 16:22
|
|
|
I am back with my VPN results Yar! This is what I got when I setup the router to see if the vpn worked, I got it every few times I tried to ping the other network or every few minutes, not sure which: Jul 8 12:42:56.955: %CRYPTO-4-RECVD_PKT_INV_SPI: decaps: rec'd IPSEC packet has invalid spi for destaddr=222.222.222.222, prot=50, spi=0xDD21CD26(3709979942), srcaddr=333.333.333.333 What is spi? code:
|
|
#
?
Jul 8, 2010 16:58
|
|
|
Bardlebee posted:I am back with my VPN results Yar! This is what I got when I setup the router to see if the vpn worked, I got it every few times I tried to ping the other network or every few minutes, not sure which: SPI = Security Parameter Index. And the docs from cisco on that error message are: cisco posted:%CRYPTO-4-RECVD_PKT_INV_SPI : decaps: rec'd IPSEC packet has invalid spi for destaddr=[IP_address], prot=[dec], spi=[hex]([dec]) code:code:
|
|
#
?
Jul 9, 2010 17:37
|
|
|
Ok this is what I got from the two show commands: It should be noted that this is the only Cisco router I have and that the destination router is a crappy RouteFinder brand which I have never heard of. code:
|
|
#
?
Jul 12, 2010 13:31
|
|
|
The output of "show crypto isakmp sa" indicates phase1 has failed; thus the output of "show crypto ipsec sa" is never going to show a phase2 association. You need to "debug crypto isakmp" to find out what's wrong with phase1. It's likely either an isakmp policy mismatch or a preshared key mismatch. For best results debug at both ends.
|
|
#
?
Jul 12, 2010 15:38
|
|
|
inignot posted:The output of "show crypto isakmp sa" indicates phase1 has failed; thus the output of "show crypto ipsec sa" is never going to show a phase2 association. I wish I could debug both ends, but again the destination router is not a Cisco. It is a retail VPN router, which I am not sure if that is the thing causing the issue. I will try the debug, thanks for the advice!
|
|
#
?
Jul 12, 2010 16:36
|
|
|
I have a 2960G-48 connected to a NAS cluster via 1Gb. I see a lot of outDiscards on the port the NAS is using. From what I understand this could mean that the port is being overloaded, do you think that could be the case? What's the best way to check port utilization? 1280-2960G-48-2#show interfaces GigabitEthernet0/39 counters errors Port Align-Err FCS-Err Xmit-Err Rcv-Err UnderSize OutDiscards Gi0/39 0 0 0 20 20 83009 Port Single-Col Multi-Col Late-Col Excess-Col Carri-Sen Runts Giants Gi0/39 0 0 0 0 0 20 0
|
|
#
?
Jul 12, 2010 19:03
|
|
|
sh int gig0/39 controllers sh int gig0/39 summary Are both good ways to check utilization. You'll have to calculate the % yourself but it works. Remember that a 2960G is a blocking architecture, so if you are trying for sustained Gigabit throughput you are going to get lots of dropped packets. If you want line rate I think the smallest Cisco switch that will accommodate you is a 3560E.
|
|
#
?
Jul 12, 2010 19:38
|
|
|
Mulloy posted:I'm not sure where to put this question, but it's the best place I could find since there are basically no other threads close. Here is the Asterisk thread which sort of became the general VoIP thread. As for your question, for the Cisco phones the best information I've found is at the VoIP-Info wiki if you're not using a Cisco Call Manager setup, otherwise Cisco's docs and this thread would probably be most useful. On the Polycom side, you'll want the Admin Guide for whatever firmware release you're running. Start from the config files Polycom provides with the firmware image and modify as you see fit. There's also a config file management guide in their documentation which describes how to set up the config server. If you have more questions on the Polycom end of things head over to the thread linked earlier.
|
|
#
?
Jul 13, 2010 02:12
|
|
|
I have a T1 that is bouncing. When it bounces, syslog usually reports that it goes down then right back up within about 4 hundreths of a second. I called my ISP to report the problem last week and they had a monitor on the circuit all weekend and could not see any trouble. I have two questions A) Is there a way for me to do any more enhanced logging on this circuit to provide any more information to my ISP B) I have 8 T1s in this router, could it possibly be the router that is the problem?
|
|
#
?
Jul 13, 2010 13:52
|
|
|
Is it the interface or line protocol that is bouncing?
|
|
#
?
Jul 13, 2010 14:23
|
|
|
For A not really, you can do show controller outputs and see if you are getting CRC errors or something like that. For B of course, the trick is convincing the ISP that the problem is on their side.
|
|
#
?
Jul 13, 2010 14:24
|
|
|
Martytoof posted:Is it the interface or line protocol that is bouncing? I'm not entirely sure. Here is the latest bounce direct from my syslog 2010-07-13 02:21:56 Local0.Notice 10.10.10.225 31264: Jul 13 07:22:00.471: %CONTROLLER-5-UPDOWN: Controller T1 0/3/1, changed state to down (RAI detected) 2010-07-13 02:21:56 Local0.Notice 10.10.10.225 31265: Jul 13 07:22:01.471: %CONTROLLER-5-UPDOWN: Controller T1 0/3/1, changed state to up 2010-07-13 02:22:01 Local0.Notice 10.10.10.225 31266: Jul 13 07:22:05.471: %CONTROLLER-5-UPDOWN: Controller T1 0/3/1, changed state to down (RAI detected) 2010-07-13 02:22:01 Local0.Notice 10.10.10.225 31267: Jul 13 07:22:06.471: %CONTROLLER-5-UPDOWN: Controller T1 0/3/1, changed state to up quote:For B of course, the trick is convincing the ISP that the problem is on their side Him: We monitered the connection all weekend and saw no issues Me: Well, it bounced up and down several times as indicated in my syslog Him: Ok well we are going to close the ticket call us back if there are any more problems EDIT: Took out the code formating because it broke the page. Syano fucked around with this message at 14:29 on Jul 13, 2010 |
|
#
?
Jul 13, 2010 14:26
|
|
|
Call back, ask for a manager and politely tell him that your ticket was closed when you specifically said you are still experiencing issues. There's no way any serious "trace" wouldn't have shown an interface coming up and down unexpectedly. Even if the problem was with your hardware, it should have brought the line protocol down on both ends momentarily. You can run a T1 loopback test to make sure it's not your hardware if you're feeling up to bringing down the interface for a while, info here. I've never actually experienced this in a production environment (and I don't use T1 cards in the lab) so at this point I'm just stabbing but I'd also like to see if you're getting any CRC or framing errors. I know these bounces are intermittent, but do they come with at a regular interval or do they seem pretty random? Actually, there's more info on RAI errors here: http://www.cisco.com/en/US/tech/tk713/tk628/technologies_tech_note09186a00801069ff.shtml#topic2 -- they also recommend a loopback test to rule out your hardware. some kinda jackal fucked around with this message at 14:52 on Jul 13, 2010 |
|
#
?
Jul 13, 2010 14:39
|
|
|
Sure. I just cleared up the counters to start fresh. Its a point to point link so I cleared up the counters on both sides. I will collect data for a bit and post back with what I come up with.
|
|
#
?
Jul 13, 2010 14:50
|
|
|
RAI is remote alarm indication- has your ISP opened a ticket with whatever LEC/IXC is carrying the circuit? Something in the path must have seen an alarm to start injecting an RAI.
|
|
#
?
Jul 13, 2010 14:50
|
|
|
Syano posted:Sure. I just cleared up the counters to start fresh. Its a point to point link so I cleared up the counters on both sides. I will collect data for a bit and post back with what I come up with. Oh my bad I thought the other end was the ISP's, so they wouldn't have seen any line protocols going down. Well it's still bad form to close a ticket when your customer is complaining 
|
|
#
?
Jul 13, 2010 14:55
|
|
|
After about an hour this is what my counters show on either side of the linkcode:code:This is the result of show controller t1 on the far end router code:
|
|
#
?
Jul 13, 2010 15:54
|
|
|
I have a pair of ASA 5505s with an IPSEC tunnel between them. Site A has a Windows NPS (RADIUS) server at 192.168.1.2 that I'd like to authenticate Site B's RA VPN users against. I have RADIUS clients configured in NPS for each of the ASAs. Site A's ASA can authenticate just fine when I do a "test aaa auth...". Site B's comes back with ERROR: Authentication Server not responding: No error Here's the relevant config from Site B: code:
|
|
#
?
Jul 13, 2010 16:09
|
|
|
Syano posted:Not entirely sure how to interpret that but I do see some things that concern me. Have your ISP loop up that circuit and run quasis for an hour. They'll see the problem. edit: 238 ES over 24 hours might be harder to catch. Have them pull PM first so they can at least confirm they're seeing problems.
|
|
#
?
Jul 13, 2010 16:19
|
|
|
Is it possible that the cabling between the demarc and consumer device on the far end router could be causing issues which the ISP wouldn't be able to trace? I'm a little unclear as to what ISPs typically do to debug these sorts of line problems.
|
|
#
?
Jul 13, 2010 16:26
|
|
|
Martytoof posted:Is it possible that the cabling between the demarc and consumer device on the far end router could be causing issues which the ISP wouldn't be able to trace? I'm a little unclear as to what ISPs typically do to debug these sorts of line problems. That's -possible- but the way to rule it out is to have the provider loop the circuit and if errors are still incrementing then it's the circuit or shelf-card that's causing problems. If they loop and come up with zero errors, then it's either the premises wiring, or the interface card on the router.
|
|
#
?
Jul 13, 2010 17:07
|
|
|
|
| # ? May 14, 2024 13:04 |
|
|
Richard Noggin posted:I have a pair of ASA 5505s with an IPSEC tunnel between them. Site A has a Windows NPS (RADIUS) server at 192.168.1.2 that I'd like to authenticate Site B's RA VPN users against. I have RADIUS clients configured in NPS for each of the ASAs. Site A's ASA can authenticate just fine when I do a "test aaa auth...". Site B's comes back with ERROR: Authentication Server not responding: No error So you have a private IP address on the outsdie interface? Presumably the public IP Space? If that is the case how would the ASA know where 192.168.2.1 is coming from, and how would it get back? code:ate shit on live tv fucked around with this message at 22:24 on Jul 13, 2010 |
|
#
?
Jul 13, 2010 22:16
|
|