Re: CEF problemi

SLM Mesut 
sorun banka sitelerinde ise banka sitelerini sadece bir switchden göndersen nasıl olur .
Eğer  karısık değil diyorsan nbar ile url içerisinde banka gecenleri interface e girişte   dscp lerini set etsen  daha sonra pbr ile dscp set edilmiş paketlerin next hopunu değiştirsen vede pbr yapsan .aşağıda örnek bir config  düşündüm ama test edemedim  .


Router(config)#class-map match-any banks
Router(config-cmap)#match protocol http url "*bank*"
Router(config-cmap)#match protocol http url "*sube*

Router(config)#policy-map mark-inbound-banks
Router(config-pmap)#class banks
Router(config-pmap-c)#set ip dscp 1




Router(config)#interface e 0/0
Router(config-if)#service-policy input mark-inbound-banks



Router(config)#route-map bank
Router(config-route-map)#match ip dscp 1 
Router(config-route-map)#set interface gig 2/2 yada set ip next -hop  hangisi uyarsa


biraz karısık ama denenebilir


--- On Tue, 5/12/09, Mesut CAP <[email protected]> wrote:

> From: Mesut CAP <[email protected]>
> Subject: Re: [cisco-ttl] CEF problemi
> To: [email protected]
> Date: Tuesday, May 12, 2009, 6:07 PM
> Merhaba;
> 
> Asagidaki durumda problem cikiyor yani bankalar baglantiyi
> birden
> sonlandiriyor.
> 
> 4500#
> O*IA 0.0.0.0/0 [110/2] via 10.0.1.25, 00:00:04,
> Port-channel2  ---> 6500-2
>                [110/2] via 10.0.1.21, 00:00:04,
> Port-channel1  -----> 6500-1
> 
> 6500#
> S*   0.0.0.0/0 [1/0] via 10.0.3.250 -->FW-2
>                [1/0] via 10.0.2.250  ---> FW-1
> 
> 
> 4500'te, 6500 lerden birine statik route yazdigimda
> sorun yok.  Su anki
> yapida 2 firewall kullanilmis cikislari ayri. Yapiyi
> degistirmek su an icin
> pek mumkun degil.
> Serhat, 4500'e bagli bir PC den firewall'a veya
> internette bi yere trace
> yaptigimda hep ayni yol kullaniliyor.
> 
> 4500#traceroute
> 74.125.79.99
> 
> Type escape sequence to abort.
> Tracing the route to 74.125.79.99
> 
>   1 10.0.1.25 0 msec  -->Port-channel2
>     10.0.1.21 0 msec  -->Port-channel1    --> Burda
> normal olmayan bisey
> varmis gibi???
>     10.0.1.25 0 msec  -->Port-channel2
>   2 10.0.3.250 12 msec 8 msec 12 msec  -->FW2
>   3  *  *  *
>   4  *  *
> 
> Source adres olarak 4500 deki bir Vlan verdigimde;
> 
> 4500#traceroute
> Protocol [ip]:
> Target IP address: 74.125.79.99
> Source address: 10.0.81.1
> Numeric display [n]:
> Timeout in seconds [3]:
> Probe count [3]:
> Minimum Time to Live [1]:
> Maximum Time to Live [30]:
> Port Number [33434]:
> Loose, Strict, Record, Timestamp, Verbose[none]:
> Type escape sequence to abort.
> Tracing the route to 74.125.79.99
> 
>   1 10.0.1.21 0 msec
>     10.0.1.25 4 msec
>     10.0.1.21 0 msec
>   2 10.0.3.250 4 msec
>     10.0.2.250 0 msec
>     10.0.3.250 4 msec
>   3  *  *  *
>   4  *  *  *
>   5  *
> 
> Firewall'a trace yaptigimda;
> 
> 4500#traceroute
> Protocol [ip]:
> Target IP address: 10.0.2.250
> Source address: 10.0.81.1
> Numeric display [n]:
> Timeout in seconds [3]:
> Probe count [3]:
> Minimum Time to Live [1]:
> Maximum Time to Live [30]:
> Port Number [33434]:
> Loose, Strict, Record, Timestamp, Verbose[none]:
> Type escape sequence to abort.
> Tracing the route to 10.0.2.250
> 
>   1 10.0.1.25 0 msec
>     10.0.1.21 0 msec
>     10.0.1.25 4 msec
>   2  *  *  *
>   3  *  *  *
>   4  *  *  *
>   5  *  *
> 
> Sinan, tesekkur ederim, loglama sansi olabilir de,
> loglamaya gerek kalmadan
> 4500 te route tablosuna esit metrikli 2 yol soktugumda
> zaten bankalara
> giremiyoruz. Diger sitelere giriliyor oysaki. 6500 lerde de
> 2 yol var ama
> 4500 lerde 2 yol oldugunda problem cikiyor. Sonuc boyle
> olunca sorunu 4500
> lerde ariyorum umarim dogru yerdir.
> 
> 
> [Non-text portions of this message have been removed]


------------------------------------

--
Cisco Teknik Tartisma Listesi (Cisco-ttl)

Bu listede onerilen degisikliklerin uygulanmasindaki tum sorumluluk 
kullaniciya aittir. Liste yoneticileri, oneride bulunan liste uyeleri ya da 
bu uyelerin calistigi kuruluslar herhangi bir sekilde sorumlu tutulamazlar.Yahoo! Groups Links

<*> To visit your group on the web, go to:
    http://groups.yahoo.com/group/cisco-ttl/

<*> Your email settings:
    Individual Email | Traditional

<*> To change settings online go to:
    http://groups.yahoo.com/group/cisco-ttl/join
    (Yahoo! ID required)

<*> To change settings via email:
    mailto:[email protected] 
    mailto:[email protected]

<*> To unsubscribe from this group, send an email to:
    [email protected]

<*> Your use of Yahoo! Groups is subject to:
    http://docs.yahoo.com/info/terms/