Questions tagged [cisco-ios]
For discussion about Cisco's Internetwork Operating System - Cisco IOS
566
questions
2
votes
3
answers
12k
views
Show all VRFs link status summary
In Cisco IOS-XE if I want to see a specific VRF's bgp connections summary I would do:
show bgp vpnv4 unicast vrf VRF_ID summary
and the result would be as below example:
Neighbor V ...
- 2,249
2
votes
2
answers
975
views
Restricting TFTP access from Host to Router using extended ACL in Cisco IOS
I am trying the below Extended ACLs to restrict TFTP but still I am able to upload files to the router using tftp. Not sure, what is wrong, can you all help?
Approach 1:
permit udp host <ip> ...
CommunityBot
- 1
3
votes
2
answers
908
views
How can I use an HTTP CRL on Cisco IOS?
On a Cisco 867 running IOS 15.6(3)M7, I'm trying to do the following:
TEST-GW1(config)#crypto pki trustpoint vpn-p2s-server-11
TEST-GW1(ca-trustpoint)#crl query http://myvpn/crls/21.crl
% URL must ...
- 81
2
votes
3
answers
17k
views
Changing Label for Generic PC in Packet Tracer
I can change easily Router and Switch names in Packet Tracer using hostname command in global config mode. But how could I change a label of a Generic PC, let's say from PC0 to Sales? i could not find ...
- 11
1
vote
0
answers
67
views
Upstream QoS garanteed bandwidth
In the network I'm trying to manage there is a satellite link, the upstream of which is ~ 7 Mbps. In this upstream, I need to allocate 1.5 Mbps of guaranteed bandwidth for one single host, but nothing ...
- 45
5
votes
1
answer
2k
views
What is the effect of using "ntp allow mode control 0"?
I am attempting to mitigate the issues surrounding bug report CSCum44673. According to the software release notes found here, I need to ensure that all of my routers are on IOS version 15.2(2) or ...
- 151
0
votes
0
answers
55
views
Is it possible to specify a bandwidth parameter per service instance?
I have a physical interface with multiple service instances and policer per service instance:
interface GigabitEthernet0/3
switchport trunk allowed vlan none
switchport mode trunk
mtu 9192
...
- 1,325
1
vote
0
answers
220
views
Configue IOS DHCP server to respond to Option 60 class
I have a number of small networks each with about half-a-dozen mostly-fixed hosts. The routers on each network provide DHCP service for the occasional visiting engineer's laptop. I am adding IP ...
CommunityBot
- 1
0
votes
0
answers
34
views
Rate limiting xFTP traffic originating from a Cisco IOS router
We have some routers on marginal cell links that we need to pull files from using TFTP or FTP. During file transfers connections to the router become so slow as to be unusable.
Is there a way to rate-...
- 656
1
vote
1
answer
1k
views
Lubuntu 18.04 can't SSH to Cisco Router: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1 [closed]
I'm not sure if this problem caused by Lubuntu or Cisco Router side.
Lubuntu = 192.168.1.100
Cisco Router = 192.168.1.1
Ubuntu 18.04.4 LTS
user@linux:~$ lsb_release -a
No LSB modules are available.
...
- 311
0
votes
0
answers
848
views
Cisco erase nvram or erase startup-config doesn't work
According to this article, I can delete the current startup configuration files and return the router to its factory default settings with the erase nvram: and reload command.
https://www.oreilly.com/...
- 311
0
votes
1
answer
328
views
Cisco IOS Sanitization: Any Way to Not Use NVRAM?
We want a method to sanitize Cisco IOS 15 routers (ISR Gen 2) before they are removed from the facility. While a "write erase" works perfectly if the router is breathing, how to sanitize dead routers ...
- 30.6k
0
votes
1
answer
303
views
Firmware of Cisco Phone
i want to configure IP phone Cisco DX650 with Sip.Anyone have idea about it how i can upload firmware of sip feature
- 2,249
2
votes
1
answer
74
views
Cisco snmp-server single user for multiple snmp versions
Attempting to maintain SNMP v2c compatibility while implementing SNMP v3 on cisco switch 5506cx.
Would a user that was previously used for v2c see issues with v2c if it is added to a v3 group?
For ...
- 301
2
votes
1
answer
2k
views
Link Aggregation from Cisco to Palo Alto using 10 gig interfaces, port on Cisco shows "waiting to be aggregated"
I am trying to bundle two 10-Gig interfaces on PA-3020 to Cisco Cat9300. Previously, I had bundled two Gigabit interfaces on same devices and everything worked fine. But now, when I try to configure ...
- 136
2
votes
1
answer
320
views
Prevent static NAT to respond to ARP requests
We are trying to merge 2 networks with overlapping IP spaces: This is the configuraiton so far:
interface Tunnel1
description VPN Port CompanyA
ip vrf forwarding LAN
ip address 172.18.0.79 255.255....
2
votes
0
answers
3k
views
Cisco AIR-AP1852i-E-K9 stuck in "waiting for uplink[...]" after startup
I pulled an old cisco AP from a shelf today at work to test something, and after starting up and connecting with PUTTy, i was greeted with (after startup), this - repeating over and over:
[*02/16/...
- 133
0
votes
0
answers
127
views
Cisco C3750 and PRTG netfllow
I have a core switch (backbone) of our network that broadcasts all the vlans to other switches. I am trying to configure netflow on the switch and link it up to a Netflow sensor on PRTG.
I followed ...
- 85
4
votes
1
answer
3k
views
Disable reset button on Cisco 2950?
On the front panel of a Cisco 2950 is a button which can be used to reset the switch to factory defaults, when held down for a few seconds.
Does anyone know of a way to disable this within IOS?
Many ...
1
vote
1
answer
1k
views
What is the difference between trustpool and trustpoint on Cisco IOS?
On Cisco IOS, there is trustpool and there is trustpoint. I have seen imported certificates in either of the two. And it seems SSL connection works when either location has the certificate it needs. ...
- 4,660
2
votes
2
answers
468
views
Listen-only (stealth) CDP on IOS
I would like to put my router in a listen-only mode for CDP i.e. it should allow CDP packets to only arrive while not advertising so that I can glimpse into physical topology while remaining hidden to ...
- 76.8k
2
votes
1
answer
777
views
Why would you use port security mode “protect?”
Port security offers three violation mode options:
• protect—Drops packets with unknown source addresses until you remove a sufficient number of secure MAC addresses to drop below the maximum value....
- 96.7k
0
votes
0
answers
123
views
Cisco Guestshell - Bridging of VirtualPortGroup0
i'm fiddling around with ne virtual-services functions of IOS-XE.
Is there a possibility to bring interface "VirtualPortGroup0" into a bridge domain with some physical interface of the router?
It's ...
- 457
0
votes
2
answers
73
views
Why doesn't kernel itself had entire L2/L3 protocol stack? [closed]
I know kernel itself handles protocols in layer 2, layer3 and layer 4 at ipv4 stack, but why can't kernel itself doesn't have protocols such as STP/RSTP/xSTP/OSPF...etc, implemented.
Why should we ...
- 1
4
votes
2
answers
375
views
Decreasing SNMP update timer on IOS-XR (CISCO ASR)
I've a case where i'm trying to poll SNMP information every 10 seconds from a Cisco IOS-XR devices (interfaces mib). Seems like CISCO IOS-XR updates SNMP information every 15secs, so sometimes ...
- 113
1
vote
1
answer
424
views
TCP handshake immediately RST [closed]
I'm trying to set up a modbus TCP connection on port 502 but get a RST packet immediatly. So the TCP connection handshake doesn't even succeed.
This is done on a windows machine on an ESX server.
The ...
- 16
1
vote
1
answer
70
views
Filter tagged route to downstream routers
I'd like to filter a redistributed route from EIGRP into OSPF to all routers in AREA2 and AREA34. I have tagged the route 10.90.100.0/24 with tag 90 at the Tampa router where its redistributed into ...
- 2,113
0
votes
1
answer
180
views
Cisco Zone Based Firewall
I have Cisco 891F configured with ZBF from CBAC. Right now, router is wide-open SSH/443 or anything my public address is listening on, which is not what I intended. My intention was to only allow IMCP ...
- 123
0
votes
1
answer
130
views
WebAuth With RADIUS For Switch Web Portal
I have a Cisco IE4000 running IOS 15.2. I am trying to login with my RADIUS credentials to the web portal for the switch. Currently the RADIUS is configured for successful login to Console and SSL but ...
- 131
0
votes
1
answer
104
views
DHCP when you have both layer 3 and switch ports
I have the following config:
ip dhcp pool Vlan10
network 192.168.1.0 255.255.255.0
default-router 192.168.1.1
interface GigabitEthernet0/0
!
interface GigabitEthernet0/0.10
encapsulation ...
- 16.3k
1
vote
0
answers
86
views
HTTPS QOS and policing [closed]
In our office, everything runs on HTTPS. We have softphones and web-based clients which are high priority. We also have Google search, maps and other low priority websites that should work on best-...
- 113
0
votes
0
answers
71
views
cisco zone-based policy firewall
How to limit the number of established connections for each host, that connect to the service? In the policy settings, I found only blocking by the number of half open connections.
parameter-map type ...
- 1,660
0
votes
2
answers
540
views
What does the Cisco HTTP client (help to) do on a switch?
While checking for vulnerabilities in one of our Cisco switches I came upon this: CVE-2019-12665.
Excerpt from the CVE:
A vulnerability in the HTTP client feature of Cisco IOS and IOS XE Software ...
- 30.6k
0
votes
2
answers
5k
views
Why does yealink ip phone is not getting ip address from voice vlan?
I have configured separate vlan for voip and connected interface to it (as shown below). But the phone is not getting ip address automatically.
switch- cisco 2960-x
phone- yealink
I had tried: (on ...
- 1
3
votes
1
answer
2k
views
Moving from 12.x IOS to 15.x IOS - Cisco 3750G
Is there any issue with jumping from IOS version 12.2(35)SE5 to 15.0.2-SE11 on a Cisco WS-C3750G-48PS-S switch?
Should I upgrade to the latest 12.x first (12.2.55-SE12), and then move to the 15.x ...
- 1,732
0
votes
1
answer
70
views
Cisco IOS RA VPN with internal NAT
We have a Cisco 871 setup with a remote access VPN which works fine. However we now need the RA-VPN to be able to access an IP on the LAN which only speaks with an authorised subnet. IP addresses as ...
CommunityBot
- 1
2
votes
3
answers
12k
views
Reason of "aaa authorization exec default group tacacs+" command in Cisco IOS?
I have a following very minimalistic AAA configuration in ISR router with IOS 12.4(22)T:
aaa new-model
aaa authentication login default group tacacs+ enable
aaa authentication enable default group ...
- 31
2
votes
2
answers
407
views
How to ping from PC on EIGRP area to PC on OSPF area without middle router?
This is my topology.
And I can send a package to every router and PC within the colored area, how can I ping from a PC on EIGRP area to a PC on the OSPF area? I heard about default route but I saw it ...
- 4,660
2
votes
2
answers
202
views
How to ensure startup-config is not changed, building CCIE rack
Let me start with short background for better understanding.
We have LAB at work (Cisco devices mostly), and we would like to allow other employers connect remotely from their homes, build own labs ...
0
votes
0
answers
419
views
Prioritizing SSH, Telnet, TACACS in Cisco IOS
For Prioritizing SSH, Telnet, TACACS locally generated traffic on Cisco ASR running IOS XR, we have:
ssh server dscp 48
tacacs-server ipv4 dscp 48
Need the same for cisco GSR: 12416/PRP running IOS. ...
- 64.9k
5
votes
1
answer
2k
views
Cisco ASA multiple dynamic VPN support (defaultRAGroup-defaultl2lGroup)
Question (short)
How to set up 2 totally different dynamic l2l vpn tunnels on an ASA5506
Question (extended)
We have a Cisco ASA5506 Security Appliance and we want to set up 2 dynamic VPN setups.
...
CommunityBot
- 1
2
votes
2
answers
145
views
Suppress CLI terminal output on IOS
I would like to know if we can suppress certain lines from being displayed on the CLI. Example: I call following TCL script, that in itself calls some other scripts. What i Get on the screen is this:
...
- 1,660
0
votes
0
answers
144
views
I'm unable to see packet drops after configuration of QoS policy
I aim to send iperf traffic from Endpoint1(Client) to Endpoint2 (Server) with the following SR path = {R1, R2, R3, R4, R3, R2, R1, R2, and R3}.
First of all, the traffic generated by iperf from ...
- 145
1
vote
1
answer
367
views
Cisco 860 Disconnecting on WAN port every 30 minutes
I'm completely stuck for solution to this issue. My ISP logs show my Cisco 860 router disconnecting and reconnecting every 30 minutes and 18 seconds all day - it's noticable when browsing as the site ...
- 203
2
votes
1
answer
5k
views
How do these NTP authentication commands differ from one another?
A typical Authenticated NTP configuration looks like this:
NTP Server
R1(config)# ntp master
R1(config)# ntp authentication-key 22 md5 SECRET-NTP-KEY
NTP Client:
R2(config)# ntp authenticate
R2(...
CommunityBot
- 1
2
votes
0
answers
254
views
C2960 - Memory has insufficient capacity [closed]
Please, do you know if there is any way on how to release more processor memory from a C2960 switch without restarting it?
I am receiving an insufficient memory alarm from this switch. I noticed that ...
CommunityBot
- 1
0
votes
2
answers
237
views
Multiple 802.1x clients, single port support on a Cisco 3750 switch?
I'm thinking of using our Cisco 3750 switch with our RADIUS server for 802.1x authentication on our Ethernet ports.
If I enable 802.1x and a user connects a switch to their Ethernet jack, and the ...
CommunityBot
- 1
5
votes
1
answer
500
views
Hardening Cisco router on Internet-MANAGEMENT PLANE
I need confirmation that I understood the Cisco manual right. So my network is like this:
ISP_RTR ---x.x.x.x/30--- Perimeter/Edge_RTR ---y.y.y.y/30--- FW1 --- DMZ1
...
1
vote
0
answers
59
views
Loopback on T1 not showing up [closed]
I'm a T1 tech for a major US ISP. We regularly remotely loopback T1s (at the smartjack) and test them before the installation. Recently I got 3 new T1s in a bundle that acted weird, and I hoping you ...
- 241
4
votes
1
answer
925
views
IOS to ASA dynamic and static VPNs - sharing same crypto ACL?
Is it possible to have a dynamic and static VPN between the same IOS router and ASA, sharing same interesting traffic/crypto ACL on the ASA end? The two devices in question:
ASA 9.1 - hub/termination ...
- 76