Cisco ASA 5505 slow download or slow upload

Cisco
There was a strange problem at my costumers site where out of the sudden the Internet speeds were inconsistent. Let me clarify, the main Internet link was 50/50Mbps (provider optics) and speed in the network was sometimes 2/50Mbps and sometimes 45/8Mbps.       [wp_ad_camp_1] After checking every network device in the local network I have decided to check the ASA interfaces speed settings. Since the provider had a Cisco as their active terminal equipment and the costumer had also a Cisco ASA everything should be fine, right? I have manually chancged the uplink interface (link between provider Cisco and my ASA). In my case it was the speed 100Mbps   For some reason they would not negotiate when interface speed was set to auto.          …
Read More

Convenient Cisco Switchport Host Command

Cisco
Well, this is a short one but convenient as the title says:) This command was release by Cisco in the IOS version of 12.1(11)AX. It is very practical and a good to know command. This command basically optimizes a Layer 2 port for a host connection.   [wp_ad_camp_1] It does three things: 1) Configures a switchport interface to access mode (host mode) 2) Disables Etherchannel capabilities 3) Enables Portfast Command example: Switch(config)# interface fa0/1 (also available in interfance range command) Switch(config-if-range)# switchport host All of the said capabilities will be up and running.   Hope it helps! [wp_ad_camp_1]
Read More

Debug ICMP for Network Troubleshoot

Cisco
There is a nice little trick or tool in Cisco that we can use when we troubleshoot network problems. It is very simple and useful:) We create an Access list that filters only ICMP traffic and we turn on the debugging for that traffic.   [wp_ad_camp_1] Just follow this procedure below: R1#conf t R1(config)#access-list 101 permit icmp any any R1(config)#do debug ip packet 101 detail After creating an ACL and turning the debugging on we get the message "IP packet debugging is on (detailed) for access list 101". All we have to do now is just PING the other side that we suspect is causing us trouble.                   As you can see that we do not have Layer 2 reachability but we…
Read More

%SPANTREE-7-RECV_1Q_NON_TRUNK solution!

Cisco
After the connection between two switches could not be established I went to see the log of the uplink switch and the first thing I have noticed was this: %LINK-3-UPDOWN: Interface FastEthernet0/1, changed state to up %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to up %SPANTREE-7-RECV_1Q_NON_TRUNK: Received 802.1Q BPDU on non trunk FastEthernet0/1 VLAN300. %SPANTREE-7-BLOCK_PORT_TYPE: Blocking FastEthernet0/1 on VLAN0300. Inconsistent port type. The two switches were connected via access ports and this message was on my side, since the other side was the service provider and I was not given the technical details of "the other side". [wp_ad_camp_1]   In short, interface was receiving BPDU's which weren't supposed to be there. This was the interface configuration: interface FastEthernet0/1 description UPLINK switchport access vlan 300 switchport mode access spanning-tree portfast…
Read More

How to forward DHCP traffic through a Cisco switch?

Cisco
After moving your DHCP server and it doesn't receive client requests but everything is "OK" with the server, then that could cause a problem in your corporate environment:)       [wp_ad_camp_1] In a nutshell, the client sends a DHCPMESSAGE on its local subnet (UDP port 67) but if the DHCP server is on a different subnet then the client uses a BROADCAST address (255.255.255.255) and that represents a problem on the switch. An overcome of this problem is the "ip helper-address" which we use on the client vlan interface. Here is a simple topology:               Here is the configuration needed: interface vlan2 ip address 172.16.0.1 255.255.255.0 interface vlan3 ip address 172.20.0.1 255.255.255.0 ip helper-address 172.16.0.10 --> DHCP server IP address   Now the…
Read More

Microsoft Windows Server 2008 as NTP server for Cisco devices

Cisco, Microsoft
I wanted to use in my test environment an NTP server on Microsoft Windows Server 2008 R2 that would function as a syncing point for my Cisco routers and switches. The starting issue is that Cisco devices will not sync with Windows integrated NTP server and the reason is that Windows use SNTP as network time protocol.       [wp_ad_camp_1]   SNTP basically provides the same features as NTP, but uses a simpler algorithm to calculate the difference in time between the two network devices. Because of this algorithm, SNTP is less accurate than NTP where on the other side it uses fewer system resources. It is better and recommended to use SNTP on i.e. mobile devices and some consumer level apps where time can be a little off.…
Read More

GNS3 IPS simulation

Cisco
Here are a few notes how to successfully simulate an IPS  6 instance in GNS3. Version 7 is a little tricky to simulate so I suggest you get the IPS Manager Express and practice everything in the demo that is available when you install it.       [wp_ad_camp_1] ***Do not forget to always start GNS3 as an administrator!*** Software and tools used: GNS3 VirtualBox 0.8.1 Java JRE 6u7 IPS-4215-K9-sys-1.1-a-6.0-6-E4.iso (use Google trick to get the image-->explained on THIS link) First it is needed to create a loopback adapter which is connected to GNS3 (cloud) but Google has a good explanation of it-->e.g. LINK In the command prompt in the qemu directory (GNS3) create IPS disks and boot the IPS image itself by entering this commands: qemu-img.exe create ipsdisk1.img 512M…
Read More

Cisco LMS 3.2 Restore Procedure and Misc

Cisco
Although this procedure is written in the official Cisco documentation, I will give you my understanding (example) of it. Command  syntax is the only part where I have encountered some problems (errors).       [wp_ad_camp_1]   Here are the steps to make a successful restore in Cisco LMS 3.2: 1) Stop the Deamon Manager by entering "net stop crmdmgtd" in the Command Prompt. 2) Here is an example of the restore command. Enter this in you Windows root drive in CMD: C:\PROGRA~2\CSCOpx\bin\perl.exe C:\PROGRA~2\CSCOpx\bin\restorebackup.pl -d d:\83 -gen now -t c:\temp As you can see a command is executed in Perl. To get CMD path (example->c:\PROGRA~2), just type "dir/x" to get path list in your current location. For more detailed information about the syntax and what is what, visit http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_lan_management_solution/3.2/data_migration/guide/rsbkppl.html  …
Read More

Use CTRL+C to stop Traceroute & Ping sequence

Cisco
I've got used to end a traceroute or a ping sequence on a Cisco IOS device using CTRL+C instead of the unpractical CTRL+Shift+6.         [wp_ad_camp_1]     As Wikipedia says, CTRL+C is used to abort the current task and regain user control and that's what we want to do from our SSH/Telnet client (SecureCRT, Putty...). Just add this command to your vty or console line on the configuration: "escape-character 3". E.g. line vty 5 15 exec-timeout 30 0 password 7 ******* login local escape-character 3 Now the ASCII character table is changed and you can use the famous CTRL+C for ending a traceroute/ping sequence. [wp_ad_camp_1]      
Read More

MTU size in a MPLS network

Cisco
MTU size never crossed my mind until MPLS designed network came to the picture. After adding a switch to the network, OSPF got up, but BGP was going up and down and up and down... That led to the MTU mismatch because bigger frames are needed in a MPLS network.       [wp_ad_camp_1] The default MTU frame size is 1500 bytes, but in a MPLS design where you use labels, with every label you need a little more room. For the one label design you need to increase the MTU size to 1504 bytes. MPLS VPN, which is the most common design, uses two labels and thus you have to increase the MTU size to 1508 bytes or by eight bytes. Each label increased the size of the original…
Read More