!!!!!!!!!!!!!!!!snoop debug!!!!!!!!!!!!!!!!!!!!!!!!!!!!! SSG320M-> snoop info Snoop: OFF Filters Defined: 2, Active Filters 2 Detail: ON, Detail Display length: 1514 Snoop tunnel traffic: ON Snoop filter based on: id 1(on): IP src-ip 172.21.59.65 dst-ip 172.21.59.66 dir(B) id 2(on): IP src-ip 172.21.59.66 dst-ip 172.21.59.65 dir(B) SSG320M-> clear get db st 106392.0: ethernet3/1(o) len=146:0024dc0ae309->001d46b323b1/8100/0800, tag 540 172.21.59.65 -> 172.21.59.66/1 vhl=45, tos=00, id=8770, frag=0000, ttl=64 tlen=128 icmp:type=8, code=0 00 1d 46 b3 23 b1 00 24 dc 0a e3 09 81 00 02 1c ..F.#..$........ 08 00 45 00 00 80 22 42 00 00 40 01 89 8d ac 15 ..E..."B..@..... 3b 41 ac 15 3b 42 08 00 0d fa 04 00 4a 38 00 01 ;A..;B......J8.. 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 10 11 ................ 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f 20 21 ...............! 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f 30 31 "#$%&'()*+,-./01 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f 40 41 23456789:;<=>?@A 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 BCDEFGHIJKLMNOPQ 52 53 54 55 56 57 58 59 5a 5b 5c 5d 5e 5f 60 61 RSTUVWXYZ[\]^_`a 62 63 bc 106393.0: ethernet3/1(o) len=146:0024dc0ae309->001d46b323b1/8100/0800, tag 540 172.21.59.65 -> 172.21.59.66/1 vhl=45, tos=00, id=8771, frag=0000, ttl=64 tlen=128 icmp:type=8, code=0 00 1d 46 b3 23 b1 00 24 dc 0a e3 09 81 00 02 1c ..F.#..$........ 08 00 45 00 00 80 22 43 00 00 40 01 89 8c ac 15 ..E..."C..@..... 3b 41 ac 15 3b 42 08 00 0d 96 04 00 4a 9c 00 01 ;A..;B......J... 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 10 11 ................ 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f 20 21 ...............! 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f 30 31 "#$%&'()*+,-./01 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f 40 41 23456789:;<=>?@A 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 BCDEFGHIJKLMNOPQ 52 53 54 55 56 57 58 59 5a 5b 5c 5d 5e 5f 60 61 RSTUVWXYZ[\]^_`a 62 63 bc 106394.0: ethernet3/1(o) len=146:0024dc0ae309->001d46b323b1/8100/0800, tag 540 172.21.59.65 -> 172.21.59.66/1 vhl=45, tos=00, id=8772, frag=0000, ttl=64 tlen=128 icmp:type=8, code=0 00 1d 46 b3 23 b1 00 24 dc 0a e3 09 81 00 02 1c ..F.#..$........ 08 00 45 00 00 80 22 44 00 00 40 01 89 8b ac 15 ..E..."D..@..... 3b 41 ac 15 3b 42 08 00 0d 32 04 00 4b 00 00 01 ;A..;B...2..K... 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 10 11 ................ 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f 20 21 ...............! 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f 30 31 "#$%&'()*+,-./01 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f 40 41 23456789:;<=>?@A 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 BCDEFGHIJKLMNOPQ 52 53 54 55 56 57 58 59 5a 5b 5c 5d 5e 5f 60 61 RSTUVWXYZ[\]^_`a 62 63 bc 106395.0: ethernet3/1(o) len=146:0024dc0ae309->001d46b323b1/8100/0800, tag 540 172.21.59.65 -> 172.21.59.66/1 vhl=45, tos=00, id=8773, frag=0000, ttl=64 tlen=128 icmp:type=8, code=0 00 1d 46 b3 23 b1 00 24 dc 0a e3 09 81 00 02 1c ..F.#..$........ 08 00 45 00 00 80 22 45 00 00 40 01 89 8a ac 15 ..E..."E..@..... 3b 41 ac 15 3b 42 08 00 0c ce 04 00 4b 64 00 01 ;A..;B......Kd.. 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 10 11 ................ 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f 20 21 ...............! 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f 30 31 "#$%&'()*+,-./01 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f 40 41 23456789:;<=>?@A 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 BCDEFGHIJKLMNOPQ 52 53 54 55 56 57 58 59 5a 5b 5c 5d 5e 5f 60 61 RSTUVWXYZ[\]^_`a 62 63 bc 106396.0: ethernet3/1(o) len=146:0024dc0ae309->001d46b323b1/8100/0800, tag 540 172.21.59.65 -> 172.21.59.66/1 vhl=45, tos=00, id=8774, frag=0000, ttl=64 tlen=128 icmp:type=8, code=0 00 1d 46 b3 23 b1 00 24 dc 0a e3 09 81 00 02 1c ..F.#..$........ 08 00 45 00 00 80 22 46 00 00 40 01 89 89 ac 15 ..E..."F..@..... 3b 41 ac 15 3b 42 08 00 0c 6a 04 00 4b c8 00 01 ;A..;B...j..K... 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 10 11 ................ 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f 20 21 ...............! 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f 30 31 "#$%&'()*+,-./01 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f 40 41 23456789:;<=>?@A 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 BCDEFGHIJKLMNOPQ 52 53 54 55 56 57 58 59 5a 5b 5c 5d 5e 5f 60 61 RSTUVWXYZ[\]^_`a 62 63 bc 106404.0: ethernet3/1(i) len=114:001d46b323c1->0024dc0ae309/0800 172.21.59.66 -> 172.21.59.65/1 vhl=45, tos=00, id=35, frag=0000, ttl=255 tlen=100 icmp:type=8, code=0 00 24 dc 0a e3 09 00 1d 46 b3 23 c1 08 00 45 00 .$......F.#...E. 00 64 00 23 00 00 ff 01 ec c7 ac 15 3b 42 ac 15 .d.#........;B.. 3b 41 08 00 cb 44 00 07 00 00 00 00 00 00 06 68 ;A...D.........h ac 96 ab cd ab cd ab cd ab cd ab cd ab cd ab cd ................ ab cd ab cd ab cd ab cd ab cd ab cd ab cd ab cd ................ ab cd ab cd ab cd ab cd ab cd ab cd ab cd ab cd ................ ab cd ab cd ab cd ab cd ab cd ab cd ab cd ab cd ................ ab cd .. 106406.0: ethernet3/1(i) len=114:001d46b323c1->0024dc0ae309/0800 172.21.59.66 -> 172.21.59.65/1 vhl=45, tos=00, id=36, frag=0000, ttl=255 tlen=100 icmp:type=8, code=0 00 24 dc 0a e3 09 00 1d 46 b3 23 c1 08 00 45 00 .$......F.#...E. 00 64 00 24 00 00 ff 01 ec c6 ac 15 3b 42 ac 15 .d.$........;B.. 3b 41 08 00 c3 6e 00 07 00 01 00 00 00 00 06 68 ;A...n.........h b4 6b ab cd ab cd ab cd ab cd ab cd ab cd ab cd .k.............. ab cd ab cd ab cd ab cd ab cd ab cd ab cd ab cd ................ ab cd ab cd ab cd ab cd ab cd ab cd ab cd ab cd ................ ab cd ab cd ab cd ab cd ab cd ab cd ab cd ab cd ................ ab cd .. 106408.0: ethernet3/1(i) len=114:001d46b323c1->0024dc0ae309/0800 172.21.59.66 -> 172.21.59.65/1 vhl=45, tos=00, id=37, frag=0000, ttl=255 tlen=100 icmp:type=8, code=0 00 24 dc 0a e3 09 00 1d 46 b3 23 c1 08 00 45 00 .$......F.#...E. 00 64 00 25 00 00 ff 01 ec c5 ac 15 3b 42 ac 15 .d.%........;B.. 3b 41 08 00 bb 98 00 07 00 02 00 00 00 00 06 68 ;A.............h bc 40 ab cd ab cd ab cd ab cd ab cd ab cd ab cd .@.............. ab cd ab cd ab cd ab cd ab cd ab cd ab cd ab cd ................ ab cd ab cd ab cd ab cd ab cd ab cd ab cd ab cd ................ ab cd ab cd ab cd ab cd ab cd ab cd ab cd ab cd ................ ab cd .. 106410.0: ethernet3/1(i) len=114:001d46b323c1->0024dc0ae309/0800 172.21.59.66 -> 172.21.59.65/1 vhl=45, tos=00, id=38, frag=0000, ttl=255 tlen=100 icmp:type=8, code=0 00 24 dc 0a e3 09 00 1d 46 b3 23 c1 08 00 45 00 .$......F.#...E. 00 64 00 26 00 00 ff 01 ec c4 ac 15 3b 42 ac 15 .d.&........;B.. 3b 41 08 00 b3 c2 00 07 00 03 00 00 00 00 06 68 ;A.............h c4 15 ab cd ab cd ab cd ab cd ab cd ab cd ab cd ................ ab cd ab cd ab cd ab cd ab cd ab cd ab cd ab cd ................ ab cd ab cd ab cd ab cd ab cd ab cd ab cd ab cd ................ ab cd ab cd ab cd ab cd ab cd ab cd ab cd ab cd ................ ab cd .. 106412.0: ethernet3/1(i) len=114:001d46b323c1->0024dc0ae309/0800 172.21.59.66 -> 172.21.59.65/1 vhl=45, tos=00, id=39, frag=0000, ttl=255 tlen=100 icmp:type=8, code=0 00 24 dc 0a e3 09 00 1d 46 b3 23 c1 08 00 45 00 .$......F.#...E. 00 64 00 27 00 00 ff 01 ec c3 ac 15 3b 42 ac 15 .d.'........;B.. 3b 41 08 00 ab ec 00 07 00 04 00 00 00 00 06 68 ;A.............h cb ea ab cd ab cd ab cd ab cd ab cd ab cd ab cd ................ ab cd ab cd ab cd ab cd ab cd ab cd ab cd ab cd ................ ab cd ab cd ab cd ab cd ab cd ab cd ab cd ab cd ................ ab cd ab cd ab cd ab cd ab cd ab cd ab cd ab cd ................ ab cd .. SSG320M-> !!!!!!!!!!!!SSG320 GET CONF!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! get config unset key protection enable set clock timezone 0 set vrouter trust-vr sharable set vrouter "untrust-vr" exit set vrouter "trust-vr" unset auto-route-export exit set alg appleichat enable unset alg appleichat re-assembly enable set alg sctp enable set auth-server "Local" id 0 set auth-server "Local" server-name "Local" set auth default auth server "Local" set auth radius accounting port 1646 set admin name "netscreen" set admin password "nKVUM2rwMUzPcrkG5sWIHdCtqkAibn" set admin auth web timeout 10 set admin auth server "Local" set admin format dos set zone "Trust" vrouter "trust-vr" set zone "Untrust" vrouter "trust-vr" set zone "DMZ" vrouter "trust-vr" set zone "VLAN" vrouter "trust-vr" set zone id 102 "HSGR-ADMS-OOB" set zone id 103 "C2-NREMS-OOB" set zone id 100 "OOB-3560" set zone "Untrust-Tun" vrouter "trust-vr" set zone "Trust" tcp-rst set zone "Untrust" block unset zone "Untrust" tcp-rst set zone "MGT" block unset zone "V1-Trust" tcp-rst unset zone "V1-Untrust" tcp-rst set zone "DMZ" tcp-rst unset zone "V1-DMZ" tcp-rst unset zone "VLAN" tcp-rst set zone "HSGR-ADMS-OOB" tcp-rst set zone "C2-NREMS-OOB" tcp-rst set zone "OOB-3560" tcp-rst set zone "Untrust" screen tear-drop set zone "Untrust" screen syn-flood set zone "Untrust" screen ping-death set zone "Untrust" screen ip-filter-src set zone "Untrust" screen land set zone "V1-Untrust" screen tear-drop set zone "V1-Untrust" screen syn-flood set zone "V1-Untrust" screen ping-death set zone "V1-Untrust" screen ip-filter-src set zone "V1-Untrust" screen land set interface "ethernet0/0" zone "Null" set interface "ethernet0/1" zone "DMZ" set interface "ethernet0/2" zone "Untrust" set interface "ethernet3/0" zone "Trust" set interface "ethernet3/1.1" tag 540 zone "OOB-3560" set interface "ethernet3/1.2" tag 900 zone "HSGR-ADMS-OOB" set interface "ethernet3/2" zone "C2-NREMS-OOB" unset interface vlan1 ip set interface ethernet3/0 ip 172.21.128.61/25 set interface ethernet3/0 route set interface ethernet3/1.1 ip 172.21.59.65/28 set interface ethernet3/1.1 route set interface ethernet3/1.2 ip 192.168.202.20/24 set interface ethernet3/1.2 route set interface "ethernet0/0" description "CONN-to-7613(NMNet)" unset interface vlan1 bypass-others-ipsec unset interface vlan1 bypass-non-ip set interface ethernet3/0 ip manageable set interface ethernet3/1.1 ip manageable set interface ethernet3/1.2 ip manageable set interface ethernet3/0 manage mtrace set interface ethernet3/1.1 manage ping unset flow no-tcp-seq-check set flow tcp-syn-check unset flow tcp-syn-bit-check set flow reverse-route clear-text prefer set flow reverse-route tunnel always set console page 0 set pki authority default scep mode "auto" set pki x509 default cert-path partial set address "Trust" "172.21.128.0/25" 172.21.128.0 255.255.255.128 set address "HSGR-ADMS-OOB" "172.21.59.66/28" 172.21.59.66 255.255.255.240 set address "HSGR-ADMS-OOB" "192.168.202.1/24" 192.168.202.1 255.255.255.0 set address "OOB-3560" "172.21.59.66/32" 172.21.59.66 255.255.255.255 set crypto-policy exit set ike respond-bad-spi 1 set ike ikev2 ike-sa-soft-lifetime 60 unset ike ikeid-enumeration unset ike dos-protection unset ipsec access-session enable set ipsec access-session maximum 5000 set ipsec access-session upper-threshold 0 set ipsec access-session lower-threshold 0 set ipsec access-session dead-p2-sa-timeout 0 unset ipsec access-session log-error unset ipsec access-session info-exch-connected unset ipsec access-session use-error-log set url protocol websense exit set policy id 1 name "ENMS to ADMS and HSGR" from "Trust" to "HSGR-ADMS-OOB" "Any" "192.168.202.1/24" "ANY" permit log count no-session-backup set policy id 1 exit set policy id 2 name "ENMS to ADMS and HSGR" from "Trust" to "HSGR-ADMS-OOB" "Any" "Any" "ANY" deny log count no-session-backup set policy id 2 exit set policy id 3 from "Trust" to "OOB-3560" "Any" "172.21.59.66/32" "ANY" permit log count no-session-backup set policy id 3 exit set policy id 4 from "Trust" to "OOB-3560" "Any" "Any" "ANY" deny log count no-session-backup set policy id 4 exit set nsmgmt bulkcli reboot-timeout 60 set ssh version v2 set config lock timeout 5 unset license-key auto-update set telnet client enable set snmp port listen 161 set snmp port trap 162 set snmpv3 local-engine id "JN1145373ADD" set vrouter "untrust-vr" exit set vrouter "trust-vr" unset add-default-route set route 0.0.0.0/0 interface ethernet3/0 gateway 172.21.128.1 exit set vrouter "untrust-vr" exit set vrouter "trust-vr" exit !!!!!!!!!!!!!Cisco 3560 sh run!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! term length 0 Switch#sh run Building configuration... Current configuration : 2566 bytes ! version 12.2 no service pad service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname Switch ! boot-start-marker boot-end-marker ! ! ! ! no aaa new-model system mtu routing 1500 authentication mac-move permit ip subnet-zero ip routing ! ! ! ! ! ! ! ! spanning-tree mode pvst spanning-tree etherchannel guard misconfig spanning-tree extend system-id ! vlan internal allocation policy ascending ! ! ! ! interface GigabitEthernet0/1 switchport access vlan 900 ! interface GigabitEthernet0/2 ! interface GigabitEthernet0/3 ! interface GigabitEthernet0/4 ! interface GigabitEthernet0/5 ! interface GigabitEthernet0/6 ! interface GigabitEthernet0/7 ! interface GigabitEthernet0/8 ! interface GigabitEthernet0/9 ! interface GigabitEthernet0/10 ! interface GigabitEthernet0/11 ! interface GigabitEthernet0/12 ! interface GigabitEthernet0/13 ! interface GigabitEthernet0/14 ! interface GigabitEthernet0/15 ! interface GigabitEthernet0/16 ! interface GigabitEthernet0/17 ! interface GigabitEthernet0/18 ! interface GigabitEthernet0/19 ! interface GigabitEthernet0/20 ! interface GigabitEthernet0/21 ! interface GigabitEthernet0/22 ! interface GigabitEthernet0/23 ! interface GigabitEthernet0/24 ! interface GigabitEthernet0/25 ! interface GigabitEthernet0/26 ! interface GigabitEthernet0/27 ! interface GigabitEthernet0/28 ! interface GigabitEthernet0/29 ! interface GigabitEthernet0/30 ! interface GigabitEthernet0/31 ! interface GigabitEthernet0/32 ! interface GigabitEthernet0/33 ! interface GigabitEthernet0/34 ! interface GigabitEthernet0/35 ! interface GigabitEthernet0/36 ! interface GigabitEthernet0/37 ! interface GigabitEthernet0/38 ! interface GigabitEthernet0/39 ! interface GigabitEthernet0/40 ! interface GigabitEthernet0/41 ! interface GigabitEthernet0/42 ! interface GigabitEthernet0/43 ! interface GigabitEthernet0/44 ! interface GigabitEthernet0/45 ! interface GigabitEthernet0/46 ! interface GigabitEthernet0/47 ! interface GigabitEthernet0/48 switchport access vlan 900 ! interface GigabitEthernet0/49 switchport trunk encapsulation dot1q switchport trunk native vlan 540 switchport trunk allowed vlan 540,900 switchport mode trunk ! interface GigabitEthernet0/50 ! interface GigabitEthernet0/51 ! interface GigabitEthernet0/52 ! interface Vlan1 no ip address shutdown ! interface Vlan540 ip address 172.21.59.66 255.255.255.240 ! ip default-gateway 172.21.59.65 ip classless ip http server ip http secure-server ! ! ip sla enable reaction-alerts ! ! ! line con 0 line vty 5 15 ! end Switch#sh int g0/49 GigabitEthernet0/49 is up, line protocol is up (connected) Hardware is Gigabit Ethernet, address is 001d.46b3.23b1 (bia 001d.46b3.23b1) MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive not set Full-duplex, 1000Mb/s, link type is auto, media type is 1000BaseSX SFP input flow-control is off, output flow-control is unsupported ARP type: ARPA, ARP Timeout 04:00:00 Last input never, output 00:00:01, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec 6 packets input, 14208 bytes, 0 no buffer Received 6 broadcasts (0 multicasts) 24 runts, 0 giants, 0 throttles 24 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 watchdog, 0 multicast, 0 pause input 0 input packets with dribble condition detected 79202 packets output, 5964870 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier, 0 PAUSE output 0 output buffer failures, 0 output buffers swapped out Switch#sh int trunjk  k Port Mode Encapsulation Status Native vlan Gi0/49 on 802.1q trunking 540 Port Vlans allowed on trunk Gi0/49 540,900 Port Vlans allowed and active in management domain Gi0/49 540,900 Port Vlans in spanning tree forwarding state and not pruned Gi0/49 540,900 Switch#ping 172.21.59.65 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 172.21.59.65, timeout is 2 seconds: ..... Success rate is 0 percent (0/5) Switch#