packet capture on cisco router/switch

*** Setup ACL
ip access-list extended CAP_ACL
permit ip host x host y

*** Setup buffer
monitor capture buffer CAP_BUFF circular

*** Filter the buffer with the ACL
monitor capture buffer CAP_BUFF filter access-list CAP_ACL

*** Setup the cap point and on what interface
monitor capture point ip cef CAP_POINT fa0/0 both

*** Assign the buffer to point
monitor capture point associate CAP_POINT CAP_BUFF

*** Show the setup
show monitor capture buffer CAP_BUFF

*** Start the cap
monitor capture point start CAP_POINT

*** Send the test traffic
send test traffic ping or telnet on the port etc

*** Stop the cap
monitor capture point stop CAP_POINT

*** show brief
show monitor capture buffer CAP_BUFF brief

*** export the capture to tftp server
monitor capture buffer CAP_BUFF export tftp://10.50.50.22/mycap.pcap

*** Open the pcap in wireshark

For 3850 - but it didn't work for me

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/epc/configuration/xe-16/epc-xe-16-book/nm-packet-capture-xe.html#GUID-DCB20ADF-1F8E-434B-AE97-54802879F34F

list of DHCP options and other voice bits

list of DHCP options
https://www.iana.org/assignments/bootp-dhcp-parameters/bootp-dhcp-parameters.xhtml

Common options
option 3 = router
option 6 = DNS servers
option 15 = domain_name
option 150 = TFTP server
option 128 = PXE - undefined (vendor specific)

Vendor options
some phone  systems use their own option for example
nortel use 128 and 191

How to set options
You can set them on the domain controller under DHCP -> Scope -> scope options

Cisco phone registration process
Step 1: Phone Loads Software (Image) and Starts the Configuration Process
Step 2a: Phone Sends DHCP Request
Step 2b: DHCP Server Sends DHCP Response
Step 3a: Phone Sends TFTP Request for a Configuration File
Step 3b: TFTP Server Sends the Default Configuration File
Step 4a: TFTP Server Sends the Specific Configuration File of the Phone
Step 4b: Phone Registration Finishes

Check voice vlan is allow and native vlan matches
Cisco
switchport mode trunk
switchport trunk allowed vlan 102
switchport trunk native vlan 102

3Com on other side
port trunk permit vlan 102  (allowed vlan)
port trunk pvid vlan 102    (native vlan)

web category lookup

http://www.brightcloud.com/

enable Microsoft NLB on cisco switch

Microsoft don't follow the rules of some RFC and Cisco doesn't like it

Some things we need from the server admin first
Real servers IP + MAC
Cluster (virtual) IP + MAC

real server1: 192.168.64.11
real server2 192.168.64.12
cluster ip: 192.168.64.13

Confirm the mac addresses and see what vlan they are on
sh arp | i 192.168.64.11
sh arp | i 192.168.64.12

See what ports those mac addresses are seen on (if its a trunk to another switch then you'll have to do same config over there)
sh mac address-table | i xxxx.xxxx.xxxx
sh mac address-table | i yyyy.yyyy.yyyy

Create static mapping for the cluster IP to cluster MAC
arp 192.168.64.13 zzzz.zzzz.zzzz ARPA

Create static mapping for cluter mac to the ports where the real servers are
mac-address-table static zzzz.zzzz.zzzz vlan 64 interface GigabitEthernet5/1

You should be able to ping the cluster IP now (you might have to visit other switches)
ping 192.168.64.13

troubleshooting wifi networks

Restrict your APs to use channels 1, 6, and 11. If they can use them all they hop around the place and often end up in the wrong place.

Check controller, check uptime.
Check controller and AP uplinks
Are WLANs properly segregated ?

Download and install Inssider and review other networks. Around. Watch during the time of the issue are other networks appearing ?

Signal strength (db)
closer to 0 is better
acceptable range
-30 to -90
I get -40 when right beside the AP
-30 to -50 = good
-60 to -70 = decent
you want at east -75
-70 to -90 will work but performance will be bad

Are clients 2.4G or 5G ? Is there lots of networks on 2 but 5 is free ?
Are all devices compatible

If you are still having issues. You can look at other radio waves interfering but need more hardware (see inssider and wispy)

failed to locate egress interface for ... on cisco asa

Came across this issue. Couldn't ssh over the VPN. They had set management-access OUTSIDE but ssh was blocked on the outside by the provider.

needed management-access INSIDE

I could ssh over the VPN
I could still connect the ASDM over the public IP

https://supportforums.cisco.com/t5/vpn/failed-to-locate-egress-interface/td-p/2323400

DNS checking website

https://www.whatsmydns.net/

useful for checking if 3rd party has created the txt record or not when setting up SSL certs with godaddy.

the txt record needs to be created on the main .domain.com not subdomain.domain.com