Quick little tutorial videos

Quick little tutorial videos

MicroNuggets - has some really useful stuff
MicroNuggets on YouTube

Configure NAT in the VRF lite scenario

Configure NAT in the VRF lite scenario
But, why would you do a VRF and then decide you wanted to route from that VRF to your global routing instance?  And why on earth would you want to NAT between two interfaces in different VRF's. 
Well, I did end up needing to and this article was very helpful.

ip vrf MyVRF
 exit

interface 
 (no switchport)           ! make routed port
 ip vrf forwarding MyVRF   ! associate interface with MyVRF
 ip address A.B.C.D M.M.M.M

interface 
 switchport
 switchport trunk encapsulation dot1q
 (switchport nonegotiate)
 switchport mode trunk

vlan 10
 name WAN-VLAN

interface Vlan10
 ip vrf forwarding MyVRF
 ip addr E.F.G.H M.M.M.M
 ip nat enable

! now the VRF-aware NAT config:
interface 
 ip nat enable

interface Vlan10
 ip nat enable

ip access-list standard LAN-to-NAT
 permit 

ip nat source list LAN-to-NAT interface Vlan10 vrf MyVRF overload

! finally the def. route
ip route vrf MyVRF 0.0.0.0 0.0.0.0 

Cisco::Firewall::IOS

Cisco IOS firewall implementation guide.

PDF

Can't get to Delta.com

I had this problem recently and a search of the internet found several interesting instances of this happening to others.
One example:http://www.experts-exchange.com/Security/Q_21649945.html

Title: Access denied due to security policy violation

When I link to some web pages, I am getting this error message:

Access denied due to security policy violation

Reject ID: 438f612b-1000c-42852404-7b6

Does this look familiar to anyone? I can't tell if it is coming from something on our end (like Checkpoint NG) or on the other end. It does not happen all the time on even the same website, just on certain pages for unknown reason.

I see several reports of this exact message on Google, but no one has an answer to the question.


Comment from HarkinsIT
Date: 01/26/2006 01:15PM PST
Comment


I have received a few complaints from my users about not being able to access particular sites, particularly delta.com. I too am running a Checkpoint firewall (NGXR60) and have found the following in the SmartDefense log: WSE0020008 found both content-length and transfer-encoding headers in response.

It's not the same exact error you are getting, RobWalling, but I was wondering if you had found a solution. I have been pouring through the SmartDefense settings and so far I haven’t been able to find anything about this.

Just wondering.....Thanks.


Comment from RobWalling
Date: 01/27/2006 11:40AM PST
Comment


After playing around with it for awhile and talking to Check Point, I finally discovered that the "ASCII Only Response Headers" criteria in the Web Intelligence piece of NGX was what was causing the problem. Turned it off, and all is well. Putting it in "Monitor Only" mode will still block it though! That really made it hard to figure out. Of course what opened myself up to, I'm not sure yet.

BTW, user ID "mobot" is someone else. I latched onto this thread because it described the same problem.

Thanks.



Comment from m298908
Date: 01/27/2006 11:42AM PST
Comment


We recently upgraded our check point software also and started having this for delta.com. It is only happening to one user though. I can get to it fine. Very strange. I will try this setting and see if it works. thx