Re: [c-nsp] Cisco SSL VPN?

2009-08-21 Thread Tony Varriale
Just note that it's not a requirement but you may need to... http://www.cisco.com/en/US/docs/security/asa/asa82/release/notes/asarn82.html tv - Original Message - From: "Ryan West" To: "Tillinger, Steve" ; "Justin M. Streiner" ; Sent: Friday, August 21, 2009 4:23 PM Subject: Re: [c-

Re: [c-nsp] Cisco SSL VPN?

2009-08-21 Thread Scott Granados
Also note that the SSL VPN is not exactly friendly with some screen reading software and other adaptive tools. If this poses a problem which it can in some instances it's something you want to consider. - Original Message - From: "Justin M. Streiner" To: "Tillinger, Steve" Cc: S

Re: [c-nsp] Cisco SSL VPN?

2009-08-21 Thread Ge Moua
We've used this free IPSec 64-bit Windows client for the Cisco VPN: http://www.shrew.net/ Regards, Ge Moua | Email: moua0...@umn.edu Network Design Engineer University of Minnesota | Networking & Telecommunications Services Eric Girard wrote: Something relatively recent that makes the lack o

Re: [c-nsp] 6500 QoS

2009-08-21 Thread Randy McAnally
We got minor packet loss and noticeably slower speeds off the bat with 'mls qos' enabled with all defaults, even with only 40-50% interface utilization. In fact it took a while to figure it out. Be very careful when you enable it if even minor packet loss will be an issue. -- Randy www.FastServ.

Re: [c-nsp] Cisco SSL VPN?

2009-08-21 Thread Bruce Pinsky
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Charles Mills wrote: > Anyone currently (successfully) using the SSL VPN on an ASA box (5520 or > above)? > > I'm in uncharted territory with this feature and not sure if it is > worth going down this route. > I am using it quite extensively in a c

Re: [c-nsp] Cisco SSL VPN?

2009-08-21 Thread Ryan West
One thing to note before upgrading to 8.2+ is the increased memory requirements. If you're using a 5510, you'll want to upgrade to a 512MB stick. -ryan -Original Message- From: cisco-nsp-boun...@puck.nether.net [mailto:cisco-nsp-boun...@puck.nether.net] On Behalf Of Tillinger, Steve Se

Re: [c-nsp] Cisco SSL VPN?

2009-08-21 Thread Eric Girard
Something relatively recent that makes the lack of 64-bit support much more palatable is the new Essentials license. It needs 8.2 code, but for short money it gives you AnyConnect client only SSL VPN support for the max number of tunnels supported by the box. It restores the cost/benefit of th

Re: [c-nsp] Cisco SSL VPN?

2009-08-21 Thread Justin M. Streiner
On Fri, 21 Aug 2009, Tillinger, Steve wrote: If you upgrade to ASA 8.2, there's a AnyConnect Essentials license which allows you use the SSL client for the number of IPsec connections your ASA is licensed for. This license is only around ~$100. So if you have a 5520 with 750 IPsec licenses, wh

Re: [c-nsp] Cisco SSL VPN?

2009-08-21 Thread Tillinger, Steve
If you upgrade to ASA 8.2, there's a AnyConnect Essentials license which allows you use the SSL client for the number of IPsec connections your ASA is licensed for. This license is only around ~$100. So if you have a 5520 with 750 IPsec licenses, when you add the AnyConnect Essentials license, yo

Re: [c-nsp] Cisco SSL VPN?

2009-08-21 Thread Tillinger, Steve
If you upgrade to ASA 8.2, there's a AnyConnect Essentials license which allows you -Original Message- From: cisco-nsp-boun...@puck.nether.net [mailto:cisco-nsp-boun...@puck.nether.net] On Behalf Of Justin M. Streiner Sent: Friday, August 21, 2009 4:22 PM To: cisco-nsp@puck.nether.net Sub

Re: [c-nsp] Cisco SSL VPN?

2009-08-21 Thread Justin M. Streiner
On Fri, 21 Aug 2009, Charles Mills wrote: Anyone currently (successfully) using the SSL VPN on an ASA box (5520 or above)? I'm in uncharted territory with this feature and not sure if it is worth going down this route. I've deployed it for a client and it seems to work pretty well, though as

[c-nsp] Cisco SSL VPN?

2009-08-21 Thread Charles Mills
Anyone currently (successfully) using the SSL VPN on an ASA box (5520 or above)? I'm in uncharted territory with this feature and not sure if it is worth going down this route. Chuck ___ cisco-nsp mailing list cisco-nsp@puck.nether.net https://puck.net

Re: [c-nsp] priority queue (like LLQ) on RSP 720

2009-08-21 Thread Everton da Silva Marques
On Thu, Aug 20, 2009 at 02:59:08PM -0400, Atif Sid wrote: > I tried using prioerity queue for Realtime traffic on RSp 702 it is not > supported. how can we prioritze realtime traffic is the core facing link is > on RSP-720. Have a look at this doc. Configuring PFC QoS http://www.cisco.com/en/US/d

Re: [c-nsp] BFD on 7600

2009-08-21 Thread Jason Plank
Just an FYI - this is a document that explains overall functionality of BFD http://www.cisco.com/en/US/technologies/tk648/tk365/tk480/technologies_white_paper0900aecd80244005.html On Fri, Aug 21, 2009 at 11:34 AM, Justin Shore wrote: > MKS wrote: >> >> Can you share your experience with BFD o

Re: [c-nsp] RP/SP BOOT synchronisation issue on 6500/7600

2009-08-21 Thread Jon Lewis
On Wed, 19 Aug 2009, Tassos Chatzithomaoglou wrote: Has anyone met such an issue? Whenever i use more than 2 files in the boot sequence, i get the SP BOOT variable desynchronized (RP BOOT is fine). I have seen it in SXH3a, SXI1, SRD2a. Is there a lower limit on the number of chars in SP BOO

Re: [c-nsp] BFD on 7600

2009-08-21 Thread Justin Shore
MKS wrote: Can you share your experience with BFD on the 7600 platform and sw release? I use it and like it. However beginning with SRB2 Cisco removed support for running BFD on SVIs. To date there is no workaround and the feature hasn't been added back to SR. Otherwise it works fine in my

Re: [c-nsp] Arp Inspection Rate Limit

2009-08-21 Thread NMaio
Found the problem with the print sever to actually be a broadcast NTP packet sent from the print server which in turn made the machines on the subnet do an arp request which in turn made the print server send arp responses. The arp responses were the reason the port would exceeded the threshold

[c-nsp] BFD on 7600

2009-08-21 Thread MKS
Hi list According to this document, BFD runs on 7600 on the hardware below http://www.cisco.com/en/US/technologies/tk648/tk365/tk381/technologies_white_paper0900aecd80243ff4_ps6599_Products_White_Paper.html Can you share your experience with BFD on the 7600 platform and sw release? The document

Re: [c-nsp] 6500 QoS

2009-08-21 Thread Phil Mayers
ML wrote: I'm about to turn on "mls qos" for the first time on a 6509E. I would like some background information from the QoS experts on this list. Last time I turned on "mls qos" it was a 3560 which has certain undesirable defaults when "mls qos" is turned on. I want avoid the same result w

Re: [c-nsp] sup32/sup720 onboard int performance

2009-08-21 Thread Phil Mayers
Jeff Bacon wrote: How are the ports that are on the supervisor module hooked into the fabric/PFC? Are they at any significant advantage or disadvantage compared to ports on linecards? IIRC they're bus-attached ports on the plain sup720. I think they're fabric-attached on the sup720-10g. The

Re: [c-nsp] IP SLA / EEM Scripting

2009-08-21 Thread Ivan Pepelnjak
Running the "telnet" command does not work too well (although it might work a bit better from Tcl EEM policy than from tclsh). http://blog.ioshints.info/2007/10/you-cannot-start-telnet-session-from.html However, you can open a TCP socket (to telnet port) from Tcl and issue the commands. You could