11

You are running into one of the fun, new, restrictions of the ISR Generation 2. I assume you have the basic "security" licensing package installed as noted by this part of the message: securityk9 technology package license However the securityk9 package is Cisco's "unrestricted export" version of that license, and will artificially limit you. You need ...


9

The key is the 'match-all' or 'match-any' part of the class-map. You may configure the class-map either way. class-map {match-any | match-all} *class-map name* If you do a "match-all" class-map, all of the match conditions must be true in order for the traffic to match. As Jeremy mentioned, creating an ACL matching the particular users and matching that ...


9

You could create a second match condition in the class-map matching all source IP networks you want to block (with an ACL). Any requests to youtube.com from a source IP not matched by this ACL will not be dropped.


9

Lets come to conculsion first before answering your question about destination NAT Destination NAT is always inbound traffic . When outside network users wants to access inside network resources it's (outside to inside) Example : Assuming you have hosted a application in your internal network and the requirement is wants to access application from internet ...


8

The two forms are equivalent. "domain-name" is the older form, and newer versions seem to prefer "domain name". Maybe at some point Cisco realized that removing the hyphen allowed them to extend the "ip domain ..." command line, i.e. you can have: ip domain name <xxx> ip domain <some other domain related function> ip domain <yet ...


8

They are the same. Cisco IOS also supports the command ip domain name starting from its 12.2 Software release. You can check it here: IOS: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr/command/ipaddr-cr-book/ipaddr-i3.html#wp1026378069 IOS-XE: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr/command/ipaddr-xe-3se-3850-cr-book/ipaddr-xe-...


7

On physical layer AUX port works on asynchronous serial RS-232 protocol. However, one can specify various application layer protocols like telnet or SSH as allowed input protocols under AUX line configuration. Am I correct that those protocols are specified only to enable or disable reverse-telnet or reverse-SSH? Short Answer: On an aux line, transport ...


7

A poor man's filter can be implemented by using NBAR to match the URL you want to block and then drop the traffic that matches. For instance if you wanted to block google you could use the following class-map match-any BlockGoogle match protocol http url *.google.* policy-map BlockGoogle class BlockGoogle drop interface gig 0/1 ...


6

Expanding upon @javano's answer... I would change one thing, instead of policing the email traffic (which will drop traffic exceeding that rate) I would recommend just setting aside a small amount of bandwidth for that traffic. Therefore, if nobody else is using the link the email can utilize the unused bandwidth policy-map PM-Limit-Emails class CM-Match-...


6

Since DHCP Discovery broadcasts initially and to avoid the need for ip-helper addresses, the L3 switch where your users or servers connect is generally the better spot for DHCP. You didn't mention multiple VLANs, and with the size equipment you have, I assumed just one, so you just need DHCP configured for that VLAN. You could put the DHCP scope on your ...


6

You can change to the SFP interface. Under the interface configuration, configure: media-type sfp To change back to the copper interface: media-type rj45


5

Work with your Cisco Partner or Cisco SE on the use for ScanSafe solution integrated in IOS: http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6525/ps6538/ps6540/data_sheet_c78-655324.html


4

Given the topology you gave in your comment. The L3 switch is probably the best place to put the DHCP server. This also sets you up in event you add an additional WAN router and have two circuits or connections coming into the office there. This would eliminate the single-point-of failure if the DHCP server were to reside on one of the routers which "went ...


4

These kind of latencies are typically related to power management. What happens is that your client wifi card sleeps all the time and only wakes up typically every 204,8 ms (DTIM interval × Beacon interval). While the station's wifi card sleeps, the AP keeps the frames that it should send to the station. Every 2 beacon, (typical value for DTIM interval), ...


4

This could be entirely normal depending on the environment (number of users, amount of traffic, etc). However there are definitely issues that can create this problem as well. To start with I would ensure that you have a newer image on the wireless device. Haven't worked on the 880 ISR's myself, but I believe the AP runs a separate image then the router ...


4

First of all you need to consider that the air is a shared media. In contrast to the switched wires where collisions are rare, in the air they are quite frequent and as a result retransmissions are part of the game. A lot of clients may compete on who will send a frame first to the access point and the losers have to retransmit. It gets worse when signal ...


4

On the router console, type show version If the image name includes the letters "K9", as in C3000-UNIVERSALK9-M, then yes. Otherwise, no. You can also type a command like show crypto isakmp sa If you don't get an error, then IPsec is available. EDIT: To enable IPSec with this IOS version, you have to buy the security license (securityk9) to enable ...


4

Check your license boot: show run | include boot And if you don't see it there already, add it like this: license boot level appxk9 *edit: in your case, you need license boot level securityk9 After adding the boot level and reloading, you should be able to accept the EULA and gain access to ISAKMP/IKE commands.


4

Enhanced Ethernet modules on ISR are hot swapable, but please note you need to Use the hw-module slot <1-4> oir-stop command when removing or replacing a hot-swappable Cisco enhanced EtherSwitch service module duringonline insertion and removal (OIR).


4

Since you have line vty 0 4 password mypassword you need to connect with "mypassword". If you want to connect with the user "mysuser" you need to enter the command line vty 0 15 login local Note that telnet is highly insecure, you should disable it and use only ssh, with transport input ssh Also you shouldn't use username myuser password 0 ...


3

Based on the information you have given; You could use a configuration like the below sample to limit traffic to a specific remote IP (I assume you need to limit traffic to your remote email server, which isn't on site, otherwise you simply could rate limit traffic to/from the email server and your WAN connection); class-map match-any CM-Match-Email-Server ...


3

The most basic license (read: cheapest) has only basic IP level functions. It'll do NAT and you can setup ACLs (filters), but there's no "firewall" or "IPS/IDS" (intrusion detection.) It this regard, it's the same as a $50 Linksys: you are "protected" by NAT. (which isn't real security)


3

Configuration mentioned above seems to be configured in router . If it is configured in router then there is no inter vlan routing is available . Two network are connected through router two interfàce . Two Vlans subnet networks will communicate by default as per your communication . No inter -Vlan routing is required to ensure communication between both ...


3

You need to determine the average and peak workloads and estimate their change over the lifetime of the router. For instance, you might have 50 total users with on average 15 users surfing online with a demand for 1 Mbit/s each, 5 Mbit/s if video is involved, or 20 Mbit/s when there's heavy cloud usage. Obviously, your Internet uplink has to be scaled ...


3

We can see that the router responds to arp requests for this IP. Disable proxy ARP on the router (no ip proxy-arp) so that the router does not answer ARP for devices on a different network. Proxy ARP is a security hole that should be disabled in any case. Cisco actually has a particular type of NAT designed for overlapping networks (outside source). See ...


2

You don't state if you have public or private addresses. Specifically 'same level of protection' as typical home user is NAPT, i.e. inbound connections are not possible unless equivalent outbound exists. If you have private addresses you've already configured NAPT if the connection works, and you have equivalent security. If you have public addresses you'...


2

In my experience what I've done is this: 1) Setup a SPAN session on the L3 Switch and send the traffic to a destination port that will do the monitoring. 2) Configure Websense to monitor website traffic by setting up policies for what is and is not allowed. I know that is probably not exactly what you are looking for, but that is the basics in a nutshell. ...


Only top voted, non community-wiki answers of a minimum length are eligible