8 votes
Accepted

2960X Management VLAN

You can disregard the dedicated management interface and simply assign an IP address to the VLAN 500 interface on the switch and use this IP for management purpose, with appropriate access lists. FE0 ...
user avatar
  • 18.4k
6 votes
Accepted

CDP Native VLAN Mismatch

This happens when something downstream of the switch doesn't understand CDP and mishandles the traffic. So, something is connecting 2/0/5 to 4/0/6; chase the wiring and you'll find it. (someone has a ...
user avatar
  • 29.6k
6 votes
Accepted

Why would Type-5 AS External OSPF Route not install in routing table?

capability vrf-lite is missing under router ospf This article has a good explanation. Essentially, the command tells OSPF to ignore the DN bit and use the LSA in the SPF calculations. https://...
user avatar
5 votes
Accepted

Access-Lists and VLAN and understanding traffic flow

This is often a confusing topic for users new to SVIs as it does seem to work a bit counter intuitively. Most people have a tendency to look at the SVI as some sort of "gateway" and that traffic ...
user avatar
  • 26.7k
5 votes
Accepted

Use BFD on a Virtual-Template Interface

Bidirectional Forward Detection (BFD) has been deactivated on virtual and dialer interfaces on newer IOS and IOS-XE versions. On earlier releases like IOS-XE 3S, the Cisco IOS software incorrectly ...
user avatar
  • 1,700
5 votes
Accepted

Firmware Compatibility with 15.x IOS versions

Is there any compatibility issues with the firmware version 15.0.2-SE11 between the following devices? There are no compatibility issues, as long as the software and basic model is identical. You ...
user avatar
  • 1,700
4 votes
Accepted

Why do Cisco IOS switches send packets to DHCP servers with zero giaddr field when DHCP snooping is on?

It's not technically setting giaddr to anything. The original request had the field empty and the switch isn't changing it, because it isn't an actual dhcp-relay. The problem is the switch adding ...
user avatar
  • 29.6k
4 votes
Accepted

Defining hierarchical BGP route-maps

In larger carriers it's actually a lot more common to actually generate the route-maps (and associated peering configurations) from some kind of provisioning database via a script. The idea is that ...
user avatar
  • 6,028
4 votes

Access-Lists and VLAN and understanding traffic flow

Think of all the ports in the vlan as being one port, traffic between them never hit the vlan-L3 interface. Only traffic flowing between vlan's hit the vlan-32 ACL. Thus traffic from vlan-X to ...
user avatar
  • 1,397
3 votes
Accepted

Cisco IOS: DNS Servers via DHCP

There are some options the client can request when IOS XE (and vanilla IOS, too) is a DHCP client. I dont' have a Catalyst 9k at hand to test, but some of it might be in there, too This is from a ...
user avatar
3 votes
Accepted

Moving from 12.x IOS to 15.x IOS - Cisco 3750G

Converting comment to an answer. You can upgrade from version 12.2(35)SE5 directly to the newest IOS version for the switch 3750 series found on Cisco download center. The upgrade process will ...
user avatar
  • 1,700
3 votes

The Netstat command equivalent on IOS 15

This is not exactly the same but may help, as it shows the far end peer address. Original command did not. But if you use "bgp listen", you then lose the foreign address! Interesting question for an ...
user avatar
3 votes

Why would Type-5 AS External OSPF Route not install in routing table?

The issue is right here in your database output: Options: (No TOS-capability, DC, Downward) At the point of redistribution the Down bit is being set as a loop prevention mechanism. By itself this ...
user avatar
  • 6,028
2 votes

The Netstat command equivalent on IOS 15

For UDP you can use Router# show udp and if you want to see detail of a particular socket then Router# show socket <PID> detail
user avatar
  • 536
2 votes
Accepted

IOS 15.2(4)E4 pipe next command changed?

The answer is that prev and next were removed in IOS 15. The closest command they have to that functionality is the section command: Show run all | section interface
user avatar
2 votes

Firmware Compatibility with 15.x IOS versions

You can mix POE and Non-POE SW. The difference between POE SW is whether power is supplied or not. You can use either of the interface power inline xxx commands. However, when the Interface is not ...
user avatar
2 votes
Accepted

C3PL working order

There are 2 different matching variations for class maps. Either match-any or match-all: match-all = logical AND of all conditions all conditions must be true for a match match-any = logical OR of ...
user avatar
  • 1,635
2 votes
Accepted

SNMPv3 context on IOS-XE does not seem to work with Prime

I found a fix for this. The trick is not to put the read community in the command. So we deployed this to all the IOS and IOS-XE switches and it works for all Vlans: snmp-server group COMPANY v3 priv ...
user avatar
  • 1,635
2 votes

QoS Policy to not overutilize WAN link

I think you're limited by physics, more than IOS commands. When you say you're shaping the bandwidth to 80%, in reality you are buffering higher bursts and then metering them out at the desired rate. ...
user avatar
  • 62.4k
1 vote
Accepted

Cisco IOS - Delay DHCP offers

Just found a workaround. You can link the status of the DHCP server to a HSRP name: interface GigabitEthernet1 ip address 172.16.220.3 255.255.255.0 standby 10 ip 172.16.220.1 standby 10 priority ...
user avatar
  • 1,635
1 vote
Accepted

Traffic flow of tunnel interfaces

So i did some labbing and got to the results myself. This is a schematic of a Cisco 892FSP router. It has a built in switch, so we have to work with vlan interfaces. If we assume traffic flowing from ...
user avatar
  • 1,635
1 vote

Restricting TFTP access from Host to Router using extended ACL in Cisco IOS

Your Approach 1 should work, provided it is applied to the interface towards the server (allow only host IP to use TFTP). If you apply that ACL on the ingress interfaces, towards the clients, it ...
user avatar
  • 70.5k
1 vote

C3PL working order

If a packet with DSCP32 arrives to be checked against this class-map, does it process the ACL? This is highly implementation-specific. For example, a particular software implementation on a ...
user avatar
  • 2,396
1 vote

Cisco ASA multiple dynamic VPN support (defaultRAGroup-defaultl2lGroup)

Try changing the crypto map sequence number for the dynamic entry to a higher one (e.g. >500), see this note: http://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/...
user avatar
1 vote

How to configure Cisco remote access IPSEC VPN between IOS Router and Android phone

Create an ACL with VPN IP address pool as source address and destination as any or specific IP address which you want to access. Bind that ACL to a client configuration group. It will work. Example: ...
user avatar
  • 161

Only top scored, non community-wiki answers of a minimum length are eligible