ARP & DNS Spoofing

Hi. This has been in my head for the past month and bloodied out looking for a solution that works.

We have an attendance system that we access over the web and about 6 weeks ago, the site was redirecting to a random IP which we didn't own and knew of

The rogue IP was just showing random text and nothing harmful obvious... my manager has been on the case since. Recently, found this application called Ettercap and used it as an exploit tool and I was able to achieve the same result with trying to redirect a domain to another IP

We believe that the "attack" originated from the inside and sort of used a tool similar to Ettercap... which I now need to counter-measure to avoid future occurrences

We use HP switches (1910s, 2530s) that have ARP anti-attack and Dynamic ARP attack - we don't see them do enough to prevent such attacks as it still happens when we are testing

I am now looking on host-based tools such as arpon which I am working on the setup (not quite sure if I got it right but DNS spoofing still happens) and looking further...

What else should I look into? We don't have an IPS/IDS appliance on the network, we use routers from a Latvian company called Mikrotik and configure them to act as firewalls.

Edit: Video URL for reference - https://www.youtube.com/watch?v=Aak6-B3JORE

Need Help - Planning to deploy DMZ

I'm quite new to networking and security. I'm plan to use the three legged networking model which consist of a single firewall. What are the requirements hardware/software and network protocol involve that i need to consider to deploy DMZ? How to configure DMZ?. Is there any documents i can refer? My client company use Barracuda NG Firewall F series.

Imaging/Cloning Computers

Hello everyone, I am needing to image/clone computers. How can I do this? any ideas? I've tried clonezilla and it did not work. If someone could give me a better tutorial on clonzilla that would be an option. Thanks in advance!

Telegram bypasses Sophos

My college has sophos UTM installed. No vpns seem to work. It's an engineering college and they have blocked access to sites like stackoverflow. The maximum file download size is 150 mb. However Telegram do not need signing in at the captive portal. No download restrictions either. How does it do that ?

GLBP?

So I have inherited a few networks now - and the most current one alternates HSRP groups between VLANs to load balance between routers.

I know what GLBP aims to do, but per my experience thus far it is almost a bad word...

Do people actually use GLBP in the wild?

Buying an APC AR3140 Without Accessories, Wondering What Else I Might Then Need

I’m buying an APC AR3140 that was being sold without accessories (cabinet and keys only) and after a few questions to the seller I’m not too concerned because of how great the price appears to be, but it made me wonder...what exactly are the accessories that would have been included new in box? Are there any I would absolutely need? Are there any I’d probably want to buy anyway? Etc.

Given that I know nothing about racks, any advice is appreciated.

Joining Equinix - Any gotchas?

I'm looking at connecting into the 350 E Cermak center. I'm going to buy dual transport from two carriers, since I'm about 170 miles away with how the crow flies.

Was curious if there's anything I should be looking out for as a gotcha? I'm going to be xconnecting some dedicated circuits, wanting to drop into the IX, and getting dual legs in (Maybe one carrier depending on price buying separate waves, but trying to get two different carriers). From what I read, I'd need a full rack to connect into the IX, since they won't let you with a half or less? There's nothing on their site of requirements or anything of the sort though.

Any obvious things I'm overlooking? I'm in a smaller datacenters with a smaller regional IX, so upgrading to the big boy league is a bit intimidating for the costs involved.

On Premise DSL

Does anyone know of a good way to re-use single twisted pair phone cabling for near gigabit Ethernet speeds?

I would love to be able to use g.fast technology over existing analog phone lines, in a sort of "on premise" dsl situation, for a customer of mine that has a really robust analog phone network between closely connected buildings, but doesn't want to re-run cabling.

I imagine that you could just us a G.fast DSLAM and CPEs, but if there was just a point-to-point G.fast bridge of sorts, that would solve the specific issue I am thinking of.

Any thoughts?

Thanks!

Anyone at Splunk’s Conf this week?

Who is hanging with Goofy in Orlando this week?

PPPoE drops connection

Basically, the connection drops out all the time, I can't determine if the problem is on the ISPs end or mine.

The first time they set this connection up it was in much worse condition, the line kept dropping every hour or even less, sometimes the link was up for no more then 5 minutes then I lost connection again. Then I tried all kinds of troubleshooting to no avail. I called customer service, they eventually came, checked the wires on the poles outside, and in our house. They wired me to the master directly. Had the exact same problem, not even the slightest improvement. So naturally and pissed I called them again, this time they replaced my slave modem, and even the master outside, this provided a noticeable improvement but still didn't fix the problem. Now the internet goes out after 6 or 5 sometimes even up to 16 hrs of usage. I could sort of live with this, but let's be honest I cannot control when the connection can drop because it's completely random, sometimes the link went out every 30 seconds for instance. For playing online this is not the ideal connection either so I have to do something.

The ACT led on the slave modem goes off for 2-10 seconds, I lose connection, the led lights up again and after waiting sometimes seconds, sometimes minutes, the connection comes back. Sometimes the router realized that I don't have internet access and the light turns amber, even though the ACT on the modem is already solid green. This is where it gets weird, this type of connection drop happens rarely but still does happen. The modem shows the link is up, but I still cannot connect to the internet, the wifi doesn't work either.

I've tried bypassing the router as well when this happens and with a solid green ACT led, the windows troubleshooter sometimes showed me Error 651 or "Your computer appears to be correctly configured, but the device or resource (DNS server) is not responding" . I've tried bypassing the router in general and that didn't fix the problem either. I also tried Google's entering public DNS but neither did that.

​

If I have to call them again it would be a bit embarrassing for me, and I guess also for them since they cannot fix the problem. At this point I don't know what else is possible to do to improve the situation.

​

The routers system log when the internet goes out looks like this : https://imgur.com/6sYJJcm

And if the DNS server doesn't respond it looks like this : https://imgur.com/fanSzIX

Network settings on the router : https://imgur.com/a/kDYfM4y

Router : TP-Link Archer C50

Slave : AccEOC21

ISP : RCS & RDS or DIGI Romania (if it matters)

I'd like to clarify I do live in a small village in sort of the middle of nowhere but that shouldn't be an excuse.

So is it just me? Or did my SSL cert reseller's site just go off line due to an expired SSL cert?

www.secure128.com

Help Choosing A Router

Let me premise, we are a mid-size production services company offering services in broadcasting, live event production, and film/television production. Some of the data we hold is wildly sensitive, and we utilize end to end encryption, disabling USB drives on edit bays, strict group policies, all the fun stuff to ensure nothing leaves this facility, and ensuring that nobody sees anything they are not permitted to.

That being said,

I need a low power router, hydro is expensive here, and our machine room is running out of power, I wanna keep it under 150w here so please no retired Cisco beasts that require their own 3 phase connection just to idle.

Router will be taking a gigabit WAN, with multiple VLANs, lots of very high bandwidth inter VLAN traffic on layer 2 switches (storage servers that are currently 4 gigabit LACP/LAGG but will become 10g in the future on one vlan, with multiple gigabit or in the future 10g storage server clients on a different VLAN), QOS for multiple VOIP SIPs.

I know my needs are a little intensive, if and when the storage server becomes 10g, and all the clients to said server become 10g, I will need to be able to place a firewall between the storage arrays and the clients, as the data on the servers is sometimes highly sensitive, but being a post production facility, the bandwidth for editing 4k+ footage in real time is a genuine need to our online suites, so I can't have any bottlenecks.

Now the real kicker, we have very little budget for this. I considered a poweredge r210 w/ pfSense, MicroTik RB3011, but with this 10g requirement looming over me, I am fearing that I may not be able to place a firewall between the VLANs without causing a serious bottleneck to the 10g network.

Suggestions? I am not a highly experienced sysadmin, and networking is a big weakness of mine. I am a senior staff member who has some IT skills so I may be doing some things wrong here, but its what the budget permits, and I know I'm gonna get a million responses saying "hire a professional" "you cant risk the lawsuit of data loss" and all that and I know, but at the end of the day its not my call, and I've tried, so your really wasting your breath.

Network firewall config recommendation needed - former admin "installed" Sonicwalls but never connected them to network.

We recently discovered some tampering in one of our datacenters and realized our former systems/network admin left us in worse shape than we were led to believe - need recommendations on best practices config. I stopped doing network admin back early 90's, so my more contemporary network skills stop at your typical home routers.

We have two datacenters with multiple public IPs, a Cisco 2800, and a Sonicwall TZ600 in each. Our original layout has the Cisco's providing NAT, the VPN link between the two datacenters, and VPN connectivity for a few clients. We picked up the Sonicwalls about 3 years ago and were under the impression the former admin had installed them, but on a recent trip to the datacenters the owner and I found that they were powered on, but not cabled in.

The owner is under the impression we can enable some type of 'passthrough' mode in the Sonicwall that would allow him to put them between the datacenter drop and our Cisco, but from what I'm reading it feels like we should be moving the NAT to the Sonicwall, and possibly either eliminate the Cisco or relegate it to working as a switch.

What is the recommended way to put these into our network?

Legacy devices frying due to POE. Can anybody recommend a device that will block the signal?

We have Brocade/Ruckus ICX devices that pass POE on the data pairs, unfortunately, otherwise I'd just strip the POE pairs.

A curious situation

Alright, I want to first say that I don't know much about networking, and additionally I don't think this is the typical post to this subreddit, so I apologize. I live in a University affiliated apartment, which provides the University's WiFi. However, the rooms in this specific apartment don't have Ethernet access points. In the room there a ceiling-mounted Cisco wireless access point, Model # AIR-CAP1702I-A-K9, which is plugged into a typical Ethernet cat-5e wire. I disconnected the access point, and plugged my Tenda N300 wireless router into it, which resulted in a wireless connection with no access to the internet. I then plugged my computer into the Ethernet wire to get more information. The result was "Network 3, No Internet". Originally I was trying to install my own wireless network so that I could work on my software projects involving smart home electronics, but now I'm genuinely curious how an Ethernet wire can provide connection to this Cisco wireless access point, but no other devices. I've got the network connection details from my PC if they are necessary to provide. Also, I've googled extensively but I think I just don't understand enterprise networking enough to even phrase the search.

I'm a network engineer!!!

Been working in healthcare for the past 13 years and was able to score a job as a network engineer. I'm so proud to wear that title and just wanted to brag a little bit. Have a great weekend!

Report on unused ports multiple switches

I know how to clear counters and run the command to check for ports that haven't been used in a while, but I am wondering, do you know of any easy / automated solutions to run a report of this on multiple switches at a time, before I clear the counters, then run it again a week later to compare?

We don't really have network management software at the moment. I am trialing Kiwi CatTools but it seems to not have a clean way to do this.

Thank you!

IPSec Failover design

My company is looking to add a secondary LTE service to use as backup internet at one of our remote locations. We use IPSec tunnels to connect all of our remote sites back to our main location.

We are waiting on equipment to get in to test, but my current plan is this. At the main location simply add the new LTE backup IP as the secondary peerin the crypto map for that tunnel.

My next step is to setup OSPF with the remote vlans and the server vlans. Im hoping that OSPF will handle the routing over the IPSec tunnels back to the main site and dynamically adjust if the primary ever goes down. We don't have too large of a network so Im think we can use a single area for all routers.

​

I have never done anything like this so my question is will this work? Im worried that the tunnel failing over at the main site may cause issues with OSPF.

​

Will this setup work, or do you have a better idea?

Server Room / Data Center designers: What are small things you wish you had?

I manage a number of smaller server/data center environments, ranging from 2 - 20 racks of equipment. We are in the process of designing replacements for a few of the spaces. Besides the obvious requirements redundant power, HVAC, access control, etc, what are the small things you wish your spaces had?

Looking for inspiration above and beyond the typical rack and raised floor.

First-time VLAN user, could use some critiquing

I run a small (20 user) office with a 2012r2 domain network, VOIP phones and a critical guest network (we have members in meetings all the time who need internet, not network).

Having recently moved to a new facility I'd like to reconfigure some things to improve the system. I would like to set up VLANs to segregate the domain and guest users, phones, and assorted printers/hardware, but I have never used VLANs and so I'm not sure if my plan makes sense.

My hardware: two ISP routers, one running through a Sonicwall TZ400 for data and one intended for phones-only; a TP-Link T1600 switch; a couple of TP-Link EAPs; Cisco SPA508G phones (pass-through connection to PCs); and various conference phones/TVs/etc.

My intent is: VLAN 10 for user data; VLAN 20 for phones; VLAN 30 for guest data; 40 for printers/devices that don't like 802.11q; and 100 for management.

To lay it out: 10 - All ports except guest AP, ISP router 2

20 - all ports with phones, phone system router, ISP router 2

30 - Guest AP and firewall ports

40 - as needed

100 - selected ports for admins (probably just me)

Am I thinking about this right? Will this send phones through ISP2 and everything else through the firewall and ISP1, while limiting the guest AP to go straight to the firewall? Finally, do any of these need to be tagged?

Cisco WLC, Aironet APs and Dropping Zebra QLn320

I have a warehouse with 23 AIR-CAP3702E-B-K9 and ten pickers with these custom machines and a Zebra QLn320. The QLn320 will randomly just drop. I figured it was an issue with the Zebra so I have been making modifications to the code inside. Its help but not a lot. Now I'm not sure if the issues are with the printer or the controller or an access point. I started a constant ping on three printers. Two with one user and one that was randomly going through the warehouse. I notice all the printers have weird cycle.

This is from one of them.

time=4ms
time=4ms
time=4ms
time=4ms
time=48ms
time=46ms
time=35ms
time=4ms

^this varies slightly

​

Occasionally I get a request timed out in the mix, sometimes its a full drop for 30 seconds from time to time.

​

I decided to ping google on my laptop to see my responses.

time=17ms
time=17ms
time=17ms
time=49ms
time=90ms
time=17ms

I'm at a loss of what could be causing these things to drop.

​

Any help would be much appreciated.

​

Blocking/allowing HTTPS for PCI for URL's behind CDN without decrypting?

Hi all,

I'm currently going through a PCI audit. The PCI audit requires all inbound/outbound from the network (considered the CDE) to be explicitly allowed, otherwise restricted.

​

The tricky part is, a lot of the forms we use to enter in CC info, are hosted behind a CDN (akamai). As we all know, CDN's can serve up different IP's.

​

Our Firewall (an ASA), can only block by IP. ACL's can reference a FQDN. But at the of the day, the Firewall sees the FQDN, does a DNS query, and inserts the IP into the ACL.

​

We have applications like Umbrella/OpenDNS that can block all DNS requests excepts those that are whitelisted. But that would require us to allow all HTTPS from the firewalls perspective. At that point, it would leave us susceptible to direct IP traffic (ie command and control phone homes that bypass DNS).

​

The only solution I can think of is decryption and an appliance that says... only allow explicitly defined URL's via HTTPS, otherwise block (including direct IP requests).

​

Any suggestions?

2000 feet of Belden 1268a cable

I've recently came into 2000 feet of Belden 1268a multi-conductor cable.

I'm selling the lot so if you or someone you know needs this just contact me on here.

I'd also be interested in knowing who needs this and why.

Sorry if this type of post isn't allowed, I read the sidebar and didn't see anything about selling.

Thanks!

Question about loopbacks and routing protocols

I'm trying to understand about the usage of loopback interfaces in routers. As far as I understand, whien I add a loopback interface and address in let's say, a Cisco router, I'm adding another address only accesible inside my device, like 127.0.0.1.

I've been reading lot's of posts and questions about this, my questions are:

1. Loopback addresses are only reachable from inside that particular device right?

2. Some people say that the use loopback interfaces for management, what are they talking about? Do they use those addresses for logging in into the routers? How does that work considering question 1?

3. I've been reading that you can add a BGP peer using the destination loopback address/router-id. Again, How does that work considering question 1?

I think the answer to these questions is that you can somehow advertise loopback addresses to another devices so they can connect via that address but I don't unserstand how that could be possible.

Team lead/managers - how do you split workload?

So I was just asked if I wanted a minion.

In my 20yrs I have been the guy (er, girl) who is jack of all trades, never says NO and despite being single mom to fairly young kids for 11+ years routinely have worked 80+ hour jobs as the norm.

My current record is the job that had to hire 8 guys to replace me. Lol.

Previous job I took company from <100 locations to 350+, went from managed firewall and mpls to sdwan, 1k circuits, palos, new WiFi, etc all while doing systems, storage, security, exchange, and all the vendor management and tier 2/3 support (while the “systems” guy collected tickets until I played secretary and cleared them)

I even “managed” my boss because otherwise shit slipped.

Finally the last 9m or so I was randomly given a mid level, 2 helpdesk promotions, and 2 entry level contract guys.

I wasn’t told or asked. Guys just showed up asking me what to do and I’m like who the eff are you?!?

Boss didn’t want to deal with them and hid in office so I started cross training them all, triaging tickets, and rotating circuit monitoring.

That’s my skill that surprised me most answer now because I pickup tech stuff easy, but I always thought I’d be a shit manager. Lol.

Current director just asked me if I’d be willing to manage a junior and I was like yeah cool, long as I get to do the work.

The question I have for anyone who has managed is how do you deal with smaller workloads? I’m used to an extreme workload and admittedly a bit of a control freak and a perfectionist (for myself)

I’d be awfully tempted to shift documentation, alert/monitor management, etc off on a underling and keep fun “fires” and hardware refresh type stuff for me. Lol.

I HAD to start handing off some stuff at the 350 site place but it was mostly dealing with cable guys to fix cables, pots, Wap replacements, and circuit monitor and outage stuff.

I was still doing 80% or shop level, and 100% of HQ and datacenter stuff.

Took 5 guys to kick me down to an average of 70hr weeks. Hahha.

I feel like (because I’d feel this way) giving all the shit work to a junior PFY would lead to a spork assisted suicide tho.

Multipathing via two LTE connections

Looking for a solution to multipath over two LTE connections in a moving vehicle. Also cheap is good here (nonprofit) :)

There are high-end vendors selling gear, but haven't really found out much in the opensource world. Was thinking of setting for example Raspberry PI or a mini-pc with two LTE dongles and then create GRE/something tunnels to our DC.

I'm more concerned about the latency than the throughput. I have couple 150Mbps LTE connections from two ISPs but when you drive through a tough spot the other might be 10Mbps and the other 0,1Mbps. I'd like the connection to switch over to the faster in that case, even if the second one was alive.

Usually all the cheaper end routers advertising "Dual SIM failover" have only one radio, and fail over after 10-30s downtime and then it takes a while to get the other connection up. That's quite a long time and the vehicle probably has already passed through the blind spot for the second ISP.

I've heard a story about a guy doing this with a Mikrotik router where he just duplicated packets over both LTEs and then at the DC end just dropped the packets coming in later.

Any ideas? Thanks!

Case for not using STP?

I found out the hard way that it isn’t enabled on our edge switches..... or any of our switches for that matter.

How do I access net lab ?

My teacher says we have access to net labs, we use cisco networking academy but I literally cannot find out how. I asked him on thursday but I forgot and I don't want to ask again. Were supposed to have access to net labs for intro to unix through our school emails but I cannot literally find anything about it and it's not in the syllabus. I need more practice and would appreciate if someone could help me.

​

We use netacad.com for our school work.

Hyper-V VLANs break when guest firewall reboots

Issue below is seen in both pfSense and OPNsense

I am completely baffled and looking for help.

HOST Hyper-V 2012r2

Quad Port Intel NIC

Port1 - OS shared with HOST for management 10.15.30.x subnet LAN SWITCH

Port2 not shared with HOST OS tied to physical broadband connection

Port3 not shared with HOST OS tied tp physical LAN SWITCH

Port4 not shared with HOST OS tied to secondary broadband - not part of this GUEST setup

​

VswitchWAN tied to Port2

VswitchLAN tied to Port3

​

RUCKUS R600 Wireless AP

SSID1 - no VLAN

SSID2 - Access VLAN20

​

Switches

Dell PowerConnect series ALL PORTS set to TRUNK (There are two switches with LAG between them, also set to trunk)

PowerShell on HOST - VswitchLAN set to trunk 20 with native 0

​

GUEST OS

pfSense or OPNsense (both exhibit exactly same behavior)

Add VLAN 20

Set interface parent to HN1 (LAN)

Add DHCP server for VLAN Interface

​

Everything works as expected. Wireless clients grab a lease from the VLAN subnet and are able to route to WAN

​

REBOOT firewall and the functionality breaks. I see no traffic in logs or DHCP requests on the VLAN subnet Setting a host to a static IP on the VLAN subnet also does not work, no traffic. I am at a loss.

Removing interfaces and VLAN DHCP and then adding them back restores functionality and leases are passed out and traffic flows until next reboot where everything breaks again. I am at a complete loss.

Clearly I am doing something wrong with Hyper-V or the physical setup, but not sure what.

​

FWIW - I Have tried adding additional vNICS to GUEST and configuring them to Access 20 - then adding the interface to pfSense or OPNsense - but I can not get traffic to flow this way.

​

Looking for some help here - I really need to get this worked out.

​

Thanks in advance!

​

Dual-WAN Load balancer

Hey guys and girls,

I work in a company that does networks at events as a side business. Some of these events are quite big. Most of the venues where these events happen don't have fiber connections to the site. So most of the time were are stuck with temporary cable/DSL connections. Cable connections being 500/50 Mbps and DSL connections 30/6 - 100/15 Mbps. In some cases we are even stuck with 4G LTE modems, these have very unreliable speeds.

Where we can get one connection we can get multiple.

​

Now I have been given the task to find a good way to load balance two or three WAN connections as sometimes we need higher download or upload speeds than we can get from one line.

The routers we use are Mikrotik, which I like for routing, DHCP and the likes but not for load balancing.

I'm looking for a device that can load balance 3 WAN connections in multiple ways (round robin, one line is full ->use second,....).

So far I have found that PFsense does this quite well. This would mean we could do it quite cheap with a NUC that multiple ethernet ports. Kemp also does this at a decent price. But I would like your input. What load balancers do you like. Note that we need a device, this can be 19" as our routers and switches are installed in portable 19" flight cases.

​

PS. Sorry for grammatical errors, English is not my first language

A joke

A 10G circuit. It did not work. Same single mode SFP, transmit and receive sensitivity are within threshold. Why? Take a guess.

How do I set up a private network on an enterprise WPA2 one?

I am trying to connect my Google Home Mini and other smart devices to my university network.

Like most universities in the UK, mine uses eduroam. I have ethernet ports in my room, and a WPA2 Enterprise wireless network. I have managed to successfully connect an access point to it (just an old ISP provided router), and it provides a wireless network to devices around me, however, when connecting to the network on a phone or computer (on my private access point), a captive portal is presented, and I have to log in with my uni username and password. Once I have done this I have full internet access through the private AP, however this cannot be done on a Google Home.

Is there any possible way to avoid this, and just have a my private AP registered on the network, then use it as a bridge to just connect other devices to the network?

Thanks

Cisco License Server, devices with Fuji 16.9.x

Anyone using Cisco License Server?

The new code we are testing 16.9.1 has a

caveat "requires cisco license server" for

our L3 switches with Adv Services code/ASA/ASRs.

​

From the release notes:

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/16-9/release_notes/ol-16-9-3850.html

You can use the device-led conversion feature to convert all existing, traditional licenses, to smart licenses. As part of the conversion process, migration data is sent to Cisco Smart Software Manager. Cisco Smart Software Manager creates license entitlements and deposits them in your user account.

​

I am concerned about our 3850/ASA/ASR after upgrading the code, losing the license

until we integrate the new license server.

​

Another issue, we have a air-gap testing environment with zero access to the internets,

anyone use license server on a disconnected network?

​

​

Branch Switches

Besides a few hq type building, my company is 99% retail stores with less than 15 people. The unique need is that each of those individual cost centers pays for their own stuff, so they're incredibly cost conscious.

We manage router and up (Meraki) but were looking at getting into the managing switches game, so we can better support the field. Meraki switches are astronomically expensive compared to whats out there, so I want to see what alternatives are out there. These don't need to be best of breed, but reliability and cost are the big things. Ubiquiti's switches look nice, and the prices are good. I'm aware of the non-existent support, and am OK with that for the most part. How is the management of them? Are there any other guys out there that compete in the low-cost-but-decent-switch game? We have some Cisco SFs out there, and they seem decent. JUst trying to get an idea of what the low-end switch landscape looks like right now.

Question about E-waste...

As someone who makes a living selling enterprise networking E-waste, How do you or your company decide on what to do with the old equipment? Do you or your company tend to donate or handover over to a company to sell on consignment? I have been interested in starting my own E-waste recycling company after being in the industry for almost 5 years under 2 different companies. Im just worried I could be too late to get a foot in the door if most companies tend to already have someone who takes care of their E-waste, then again I am from the Bay Area and there are many major companies out here. Thoughts?

PSA Opengear in IP passthough, 4.3.1 code, Cisco ASA - there be dragons

I just spent two days trying to get IP passthrough from cellular working with a Cisco ASA. It appears that the new Opengear 4.3.1 code introduced a bug.

The Opengear broadcasts an ARP to get the MAC address of the Cisco interface. The first such ARP correctly has the source IP set as the IP of the cellular gateway. However, subsequent ARPs have the IP address set to the Opengear's management IP address. Since this IP is not in the subnet on the ASA's outside interface, the ASA will reject it, and communications comes to a screeching halt.

The fix is to use this command on the ASA: arp permit non-connected

I have verified that this appears to be a bug with Opengear support.

Making the best out of the architect demands.

Hello again r/Networking,

After much struggle on where to locate our outdoor MIST AP61 to cover a public square, the architect left us with the only option to put them under bench banks, around 20 cm up from ground level.

We expect low to medium density most of the time, and for special occasions where high density will be required, ad-hoc APs will be deployed.

My question is, how should I tilt the AP? Options are:

• Mount it vertically, which at first seems like the best option.
• Down tilt it, to avoid getting the beams directed to the bench bank, and hope the reflection on the floor will work our way.
• Up tilt it, to try to reach further. Probably the last favorable option, as on the opposite side there will be other AP pointing in the same direction.

Any thoughts or recommendations are of course very much appreciated!

Thanks in advance!

Blogpost Friday!

It's Read-only Friday! It is time to put your feet up, pour a nice dram and look through some of our member's new and shiny blog posts

Feel free to submit your blog post and as well a nice description to this thread.

So I lost an argument about VLANs and subnets. I suppose a single switch CAN support multiple subnets without VLANs. But is there any professional who does this for any practical reason?

No text found

Looking for recommendations on a WAP for video signals at a football field.

So I am running a Tricaster TC1 and NewTek NDI Sparks that operate on Wifi as part of their feature set.

I'm looking at running two of these boxes wirelessly. I realize that I need a robust network. At the field in question, there's very little room for electricity. There's not places to expand it, but we DO have a fiber backbone for our networking. Right now, we have a PoE switch in the booth at the field and 10gb between the field and the switcher (in the main building)

I need a WAP (or two) that is going to cover the football field and blanket the area so I can have mobile cameras roaming the sidelines.

It sounds like Ubiquiti might be the way to go, but I'm confused on options. This setup would not broadcast a public SSID and would not be connected to anything by the video signals. In fact, it's literally connected to a VLAN with no other traffic on that particular network.

What would you guys recommend?

Diffie Hellman key exchange? Way to demonstrate this without color mi#ing ir numbe4s?

Thx

VoIP security query (SBC or Firewall)

Hi all,

​

I have a query about VoIP security etc... I'm OK with normal route and switch stuff, but when it comes to unified comms and security, it's a bit of a weak point, so I hoping you guys could help.

A diagram of the setup is here:

https://imgur.com/mpaLPy5

This is only one side,there is another, and it works as an Active/Active setup with VRRP... calls are load balanced

"X" doesn't currently exist, but with more users coming online, we feel "X" should... But with what?

​

Initially with some research, everything pointed towards SBC's, some of the contractor guys suggested this would be a good approach too, but looking more into it, our current IP to E1 gateway is doing a lot of the functions of an SBC, so when you factor in costs and licences, also the fact we would be using very little of the features,they seem pointless.

​

Other users (SIP Endpoints) will always be known, so a firewall seemed like the next logical choice, but what type?

​

Effectively we want to reduce/manage the risk of DoS attacks, replay attacks and just general security of the IP to E1 gateways. A routed statefull firewall seemed ideal, with some traffic policing, but how is this setup with VoIP in mind (Cisco ASA)? Also, we need something that is not too complex to make edit to for testing, faultfinding and onboarding of new users (endpoints)...I'm assuming this will be a lot of ACL manipulation? Is VRRP much of a hassle through firewalls?

​

Would a transparent FW be a better option?

​

Does it need to be an ASA at all, or could we just get a router with a security licence to do this?

​

Probably some stupid questions in here, but like I said UC and SEC aren't really something I've much experience in.

​

​

Any recommendations for tools that would map a network automatically?

I'm looking for tools that will take configuration / mac tables / routing tables from switches / routers / firewalls and automatically create a network diagram. Any suggestions?

Network Printer NICs becoming unresponsive

I work at a corp help desk for a fairly large company with thousands of locations. We typically have the back office printers at all of our units plugged into into a cisco switch, set with a static IP, so they can print via network from the back office computer.

​

The last few months I've seen a strange issue. This issue occurs on multiple models of brother printers, and HP printers.

​

A printer will go completely offline, the switch ports will show down. Printer was previously working, set up by us with proper config, end users are completely locked out from changing settings. First thing I always do is check for port violations because we see those all the time. After a ton of swearing the end user doesn't have the cable plugged in to the switch etc, we've discovered that resetting the printers network settings and reprogramming the IP address, subnet, etc will completely resolve the issue.

​

As a one off, it's not a big issue. But the fact that it keeps occurring, with completely different makes and models makes me wonder. After seeing this several dozen times I asked my level two if they knew what could be causing this. They didn't really have any ideas or seemed too concerned since most of these calls don't make it to them.

Are NICs in printers just complete shit that go out all the time? Or is there potentially another cause?

Is SecureCRT license lifetime permanent right to use [with 1-3y update support] or it will deactivate after expiry date?

Basically the title. I'm in deep love with SCRT in my workplace and I wanted to install it at home for personal usage as well.

I intend to buy the license but their site is absolutely cryptic and I have no idea if the license is perpetual or annual.

My other option that has a BIG CONFIRMATION TEXT THAT IT IS FOR LIFETIME on the store page is mobaXterm so in case SCRT is not permanent I will jump on moba.

EDIT: Thanks to ppl that replied. Just purchased my side hoe :)

Crimping Cat5e Help

I have bought a flat cat5e patch cable. Snipped one end off, fed it through a hole in the wall and now I need to reconnect a replacement RJ45 connector.

I have a crimper tool, spare connectors and a tester.

But I am having trouble because the wires are much thinner than regular round cat5e.

What can I do to get this crimped?

Librenms Capacity Planning

Is there any capacity planning plugins or integrations that work well with Librenms, would be great to find something that can just grab say the two month graph and draw a long term trend line. Considering writing something myself but figured why reinvent the wheel.

Network monitoring tool with configuration management module

Hi all,

We going to setup new monitoring tool in my company.

The main requirement is to monitor 500 network devices (Dell, Juniper, Checkpoint) via SNMP + (not required but nice to have) VMware and bare-metal servers monitoring (iDRAC and iLO).

Also, we want to have possibility to collect, store and manage configuration from network devices. I have experience with BMC Entuity (Eye of Storm) tool and I know that it can do it, but the report module is really bad and also BMC support is not helpful at all.

I expect that PRTG will be a good option (I like that web panel uses HTML5 instead flash or other heavy technology). It is really easy to use, but unfortunately it does not provide any possibility to store and manage configs.

Any idea from your site? Of course, we looking for some commercial solution. Please do not propose open-source solutions.

Wired packet capture hardware / best practices?

tl;dr: what laptop hardware/software config do you recommend for performing raw, wired packet captures?

I wanted to inspect traffic traversing a trunk, so I SPAN'ned the port like so:

monitor session 1 source interface g1/4 both monitor session 1 destination interface g0/45 encapsulation replicate 

...where g1/4 is the trunk in question, and g0/45 connects to my laptop.

Starting wireshark on that interface shows a ton more traffic, compared to when I turn off the monitor session. But it looks like I'm not getting all traffic passing the trunk, and Wireshark doesn't report any 802.1q tags. Mostly bcast/mcast traffic, and I guess some ucast traffic not destined for my IP, but...definitely not all raw traffic.

What I tried

1. Ensured Wireshark is set to capture in promiscuous mode (it is on by default)
2. Found no "promiscuous mode" options in my wired NIC's driver options in Windows
3. Found an Intel article describing a registry hack to enable monitor mode, but multiple reboots/permutations gave same results

Best I can tell, my Latitude's built-in NIC (Intel I219-LM) doesn't support full promiscuous mode, at least in Win10, but I couldn't confirm one way or the other.

Edit: stupid new reddit formatting

Switching issue

Issue: A non-domain PC(PC-A) can no longer print to a networked printer.

When I print from a domain PC(PC-B) it works because the job comes from the Print Server. However I couldn't ping the printer.

So I checked the firewall and it is dropping ICMP Replies because there is no matching Request. So for some reason the ICMP Request is going through the switches directly to the printer but the Reply goes through the firewall and gets dropped.

​

Network Map:https://imgur.com/a/TovlpLn Red is the ICMP Request and Green is the Reply/

We're in the middle of a switch refresh so the infrastructure is rather funky.

​

Lab Engineer

If you work as a Network Engineer for a strictly lab environment, what's it like?

Is it boring, fun, challenging? Are you learning a lot? What do you like/dislike about it?

ELK for network monitoring - where to go?

Hi all,

We've been setting up an ELK cluster which is supposed to be the centralised data lake for our monitoring services and apps. Currently, we have the following data sent to the cluster:

1. Netflow information from routers, firewalls, datacentre, load balancer etc.
2. Syslog from all devices
3. Custom metrics from network equipment (using custom python/REST APIs and agents I can send pretty much all of the data I want, basically anything that can be displayed with a show command). We use this to send many metrics, from interface utilisation, STP events and MPLS routes to BGP-EVPN stats

My question is, what would be the best way to analyse this data and gather some informational insights on the network from it? I'd love to get some ideas or hear what you guys have seen/developed for your environments (or some general thoughts on ELK and network monitoring with it). Currently we're struggling to even analyse network failures retrospectively since some of the metrics and data (Syslog?) is not informational or doesn't seem to help that much...

My current ideas:

• Build custom ML apps using open-source tools (TensorFlow, SciKit etc.) in order to predict failures (based on all gathered metrics)
• Create some trap generating system on top of ELK (Sentinl, elastalert etc.)
• Gather some advanced metrics, such as health measurements of an app or a path of a flow in the network (and possible feed it to the ML app mentioned above)

The way I see it now, we have two main issues: how well the solution will fit ELK (just the methods, without even talking about ELK's limitations) and how hard would it be to develop and get to the production scale level...

Cheers.

Router and setup recommendations

Here's my problem:

I am a programmer and this means that the office thinks I'm also an IT or networking expert and so I must fix the slow Internet.

Our office is located in a semi-rural area. We have crap 10Mbps internet connections that constantly drops. We have two separate networks: one for 5 VOIP phones and one for regular office use. There are approximately 12 people and 20 devices total on the router. We are growing fast and will likely be ~25 before the end of the year.

Here's my tentative solution and where I would like recommendations:

• I would like to ditch one of the internet connections and replace it with one from a different ISP, so that downtime or drops are not in sync.
• I would like to put everything on a single LAN (is that a good idea?)
• I would like to have a load balancing / broadband bonding router, but I'm not sure what to buy. I would like a solution that is simple enough that I don't have to deal with an external resource, but I'm resourceful enough. Recommendations?
• Any other ideas / recommendations?

Thanks guys

Switch uptime

What's the highest uptime you've seen? I'm looking over our whole switch estate now to check on various things and noticed this one: 3 years, 7 weeks, 1 day, 20 hours, 14 minutes

Among the things I'm checking is if these things have the latest software version and guessing by the uptime, that's probably a no.

A cry for help: Save me O networking gods

Hello everyone, I have been working on upgrading the wireless internet at my company's office for the past month or so with various degrees of success and frustration.

Some background: I've been in-house IT for this company for less than a year, we are small but growing. When I got here, they essentially had a home network set up for this office through a Comcast modem and router. It is an old building made of brick and steel which are never conducive to good wifi, but it's also a large open space for the most part, so I wouldn't think building interference is the major issue.

I have a lot of experience in system administration but I'm not a network engineer. When people started complaining about internet speeds and performance, I thought at the very least we need to upgrade to a real "business" speed and service from Comcast.

So step 1: We upgrade to a higher Comcast speed and get Comcast's "WiFi Pro" service, which essentially just means they give us two APs connected to the gateway. The APs are placed on opposite sides of the office and they broadcast both Private and Public (guest) networks. Speeds are noticeably better right away on the Private network, so that's great.

What's not great is we discover that some people can't print. Everyone on the side of the office close to the printer can print without issue; everyone on the other side can't seem to "see" or connect to the printer. I've tinkered with settings on the router and APs to try to get them communicating to each other so that you could print regardless of which AP you're connected to, to no avail. If I'm connected to the AP furthest from the printer, I cannot print, cannot install that printer, cannot ping its IP address.

The printer is a Canon LBP250 series, connected wirelessly to the Private network, and this is an all-Mac company. Everyone uses Airprint to connect and print; I am not sure if that is complicating matters or not.

I will be meeting with a Comcast tech soon to troubleshoot, but I am also exploring other options. I'd like to get advice from some networking experts, which is why I'm here. Should I be looking into MSPs / contractors who could help me set up Meraki, Ubiquity, or some other product along those lines?

Fed vs. Contractor

I'm currently an IT contractor and have been recently thinking about if I should look into going over to the Fed side. Been contracting since I separated from the military about 10 years ago. I've read about all the pros and cons of each such as better pay as a contractor but less job stability, pension and TSP on the Fed side, benefits, etc.

I'm in a location where there's consistently lots of contractor job openings in my field and in the past it's only taken me a few weeks to get an interview and be hired. Also even if the contract I'm on is won by another company, as a contractor you get first right of refusal so it's not like it's a done deal that you just lost your job. I've always had good benefits, vacation time and matching 401(k)s with my companies. I don't have a family to support or a mortgage (like pretty much ALL the civilians I work with do) so it's not like if I found myself unemployed for a while it would be a big deal.

What concerns me about working on the Fed side is what happens if you get hired but end up not liking the position, place you work, co-workers, supervisor, etc. What then? That seems like I would be trapped after I've worked hard to get this "lucrative" government job. I've heard it can sometimes not be easy to transfer to another Fed position, and even if you can, comparing usajobs with contractor sites, there are WAY less openings in my field and location (we're talking single digits compared with hundreds). Compare that with the contracting side, if after I get hired and end up not liking the position, I can be out of there and in a new job within a month or so.

Reading all the posts like this, the vast majority say working on the Fed side is better, so I'm wondering if there's anybody else who works in this sector who decided the contractor side was a better fit?

Ruckus/Brocade MCT vs Stacking

I'm trying to figure out the pros/cons of Ruckus/Brocade MCT (multi-chassis trunking) vs regular stacking. We have a pair of ICX 7750s that will be LACP connected hub-and-spoke style to a few stacks of ICX 7250s. There's a holy war brewing here were one faction want's to connect the 7250s together through MCT and another faction that says stacking them would be better. The physical connections and redundancy will be exactly the same under both methods. The stacking group say their method is better because there's only one management interface, configs/tables are fully synced between all members and there's no spanning tree convergence in the event of a failure. The MCT group says that's better because there are two independent switches with seperate configs/tables and if someone screws up a live config it won't affect the other member and traffic will continue to flow. I should mention that the 7750s will be in the same rack.

​

Does anyone here have a preference for one over the other and if so, why?

DC SW <-> FW eBGP?

(TL;DR: /27-/31 subnets in DC with eBGP to FW, stupid idea or not?)

We run our own MPLS network in the campus, and it has been working great so far. Lot's of different VRFs for different use cases like "office pc" "lab analyzer" "surveillance cameras" "temperature sensors" etc. Every VRF gets the default route from FWs in DC, where we have MPLS capable switches. "Office PCs" for example has lot's of different subnets in different buildings, but they're all in the same VRF and get default route from the DC.

Currently our servers are in a single "servers" VRF with multiple subnets and we're thinking of segmenting them to multiple VRFs like the LAN is. At least all the new subnets, where we would create a small subnet holding the servers and then have BGP peering between the DC switches and the FW.

So the actual question is: is it a stupid idea to have /27-/31 DC subnets that are terminated on the firewall with eBGP peerings?

We have lot's of servers where the management is outsourced, and few where there are regulatory issues why we can't just run the windows/rhel updates there every month. I'd like to keep those as separate from everything as possible. And also if the server doesn't need to talk to other servers why should it?

NSX or something would probably be great but getting NSX for just this purpose would cost a lot more than configuring all those eBGP sessions :) We have Fortigate firewalls that can support 5000 BGP peerings IRC. Amount of servers we have is in hundreds not thousands.

If this would work fine I could also extend this to our "DMZ". Everything that's being accessed from the internet comes through our load balancers, so the servers would only need to talk to the load balancer. Using private VLANs would probably work but I'm expecting there might be few DMZ servers that need to talk to each other but not to other DMZ servers.

Thanks for any ideas!

​

If i understand my homework correctly i should split the whole class c in 16 subneworks. Just wanted to know if it is even possible or if i just don't understand his question.

Since class c goes from 192.0.0.0 to 223.255.255.255 and the subnetmask would thus begin with 110 in binary. I don't see how that could work since the 0 would mean host part and not "don't use".

I hope it's somewhat clear what i mean.

I am not looking for a solution, just for verification if that is even a possibility. thanks

edit: Since the only answers i get is that i shouldn't use classes please just read the question as "can i build subnets for the ip range from "192.0.0.0 to 223.255.255.255" and ignore the mentioning of the word class.

Ikev2 Site to Site VPN on a Palo Alto firewall towards a Cisco ASA

Hi everyone,

Has anyone here ever setup a IKEV2 site to site vpn between a Palo Alo firewall and a Cisco ASA.

I was just working with a company at setting this up. I manage the Cisco ASA and they manage the Palo Alto. I was unable to establish a successful site to site vpn using ikev2. Once we moved it to ikev1 it came up instantly.

I already have many ikev2 vpns running on my ASA to other sites successfully but none of them are to Palo Alto firewalls.

The network guys from the company I was working with told me that with Palo Alto, you keed to put in a ikev1 pre-shared key along with the remote and local authentication keys for ikev2...

I found it strange that the Palo Alto would need any ikev1 configuration if you are trying to use ikev2 as that would defeat the purpose really. Can anyone clarify what is required to setup a IKEV2 site to site vpn on a Palo Alto firewall. I have done some research but everything I find is just setting up ikev1 from what I can see.

​

Thanks in advance..

​

What are you using for log aggregation?

Wondering what people are using for log aggregation? Splunk seems to be the leader but it's very expensive. Can Graylog do much of what you need? We are looking to dump everything into it. AD / Syslog / Firewall

Thanks

DHCP Snooping

While testing this in my home lab, my understanding thus far is:

• All ports should be untrusted except
• Trunk ports leading up to the router (where DHCP is hosted)

Would this be accurate?

HPE Comware - IRF - Forwarding Traffic in an IRF ring topology -> is the shortest path chosen automatically?

Hey,

I have an IRF of 9 members. The Topology is a Ring. The members are located in different buildings of the campus.

My question is: Does an IRF always choose the shortest route internally? Is the shortest route the path with the fewest hops?

​

​

​

​

​

​

​

​

Should I go for a Level 2 switch or Level 3?

Hey,

We have about 60 retail properties.

Each location has an ASA 5506 and about 6-8 devices (Computers, Debit Machine for payments, 1-2 printers and other misc)

We'll be deploying voip so the ASA 5506 won't fit the bill as it won't have enough ports.

I don't want to throw in just a dummy unmanaged switch which all the vendors keep recommending lol.

In the future, we might roll IP camera's as well which is why I'd like to get a 24 port managed switch and vlan off the VOIP phones/IP Cameras.

For my case - would a level 2 switch be enough or should I just go with a level 3?

Also - do you have any recommendations that won't break the bank? Kind of on a tight budget. I was thinking of the CISCO SG series but I been told to stay away from those.

How to test my Site to Site VPN on a new Firewall before deploying it on site.

Hello networking Community!

You are kind of my last hope since nobody at my workplace or my Web Searches can comprehend the problem I got here.

Since I started in IT everybody always tells me ALWAYS test everything before you deploy/configure/change anything! So that's what I'm trying to live by. Here is my Layout. We have a Sophos Firewall SG 210 inhouse and a PFsense Firewall on a remote Site. There is a VPN IPSec tunnel configured between these Firewalls with each having the remote Gateway and preshared Key set. Now we want to replace the PFSense Firewall with a small Sophos Sg 105. The IP/Gateway etc. stay the same only the hardware and config are going to change. That's all good but how am I able to test the new VPN IPsec tunnel between the two Sophos Firewalls, when I only have one physical WAN/Internet Interface/connection for the Inhouse firewall and none for my new Remote Site Firewall. Is there a way that I can create a "pseudo" WAN for the new Firewall to be behind so that I can test the VPN Tunnel?

I hope I made my problem understandable.

Cloud Enterprise Network Updates and Apsara Luoshen Network Stack

No text found

Three Tier Network Design and where to place servers!

Hi all,

​

We are currently having a redesign of our network and heading to a three tier design. My question to you guys is:

Where would you place your serves? And why?

​

Core

Distribution

Access

​

Don't worry about budget or any other scenarios. Just if you could do it a particular way, what would it be

Thank you

Private AS numbering

I am in the process or building an IPSec transit network connecting my various AWS cloud based data centers to various private (on premise) data centers. This is a completely private network.

The design is hub and spoke and routing is handled by BGP. All data center locations connect to the various hub routers and the hub routers advertise routes between data centers. Some BGP route manipulation is performed on the hub routers to prefer specific paths etc. The reason for the hub and spoke design is to simplify the configuration when an additional data center is added to the existing network (it just needs to connect to the hub).

I have some BGP experience but I am not an expert. The AS numbers provided by AWS for IPSec connectivity (between my hub network and the AWS regions) are obviously controlled by them thus making the connection eBGP (because the AS number will be different from the private AS number I use on my routers). My question is specifically around the suggested numbering of private AS numbers on my own routers. Although I know that within an organization usually the same private AS number is used, I was wondering if it would be an acceptable design to use different private AS numbers for different routers. I use multiple ISPs within my network to run IPSec across multiple paths to the hub routers. When looking at the BGP routes, I find it easier to associate an AS number with a specific router rather than the BGP peer IP so for me it is easier to understand the preferred path. Is there an issue with this design? I would appreciate your input.

https://imgur.com/YxzDhhA

WatchGuard and Monitoring

Ladies and gents, boys and girls i proudly present my question!!

​

What SNMP monitoring do use for watchguards? I have tried using zabbix but it seems far to complicated, im looking at prtg and already it looks awful.

I look forward to your answers.

Interface descriptions

Hi all,

I'm faced with creating a new port description template for our DC equipment (all routers, switches, FW's and loadbalancers.) Right now it's not consistent and for many ports just a mess.

To make things worse, because we have certain sections of our network air-gaped, we also have end users directly connected with a thin client on some DC switches. For these ports, we require the MAC address of the thin client in the port description (for now.) Yet again we are also using port security sticky on these ports. This means that the MAC address also appears in the Cisco interface configuration (switchport portfast mac-address sticky.)

For now i have the following possible variables which i might (or might not) want to integrate in the description:

• Neighbor hostname
• Neighbor MGMT IP
• Neighbor interface name
• Neighbor MAC address (perhaps only for end user ports?)
• Port role(something like EDGE, CORE, USER, HA, MGMT etc?)
• Patchrack (Case and U#) and patchnumber
• Line numbers (DC interconnects)

These are values which i found in the current interface descriptions across the network.

Especially the MAC address seems a bit overkill to me. And the port role could work, but at the same time i can see it confusing my colleagues (shared DATA port with MGMT port for example.) Port roles might also be something which isn't easy to automate unless i setup a database with a port inventory with all the roles. Which is a pain in the ass and only moving the management problem to a different system.

Also i'm wondering if the line numbers for the DC interconnects shouldn't be placed somewhere else. Especially if i want a consistent template and the value is only required on ~6 interfaces per DC.

I mainly want the following requirements for the new template:

• Structured, easy to recognize template
• Consistent across all ports
• Easy to automate. I might want to implement some form of scripting to keep things organized
• Helpful, bare minimal but enough information in troubleshooting scenario's where documentation isn't available

I want to do it right for this time and not redo the whole template in another 4 years ;) So i was wondering if you guys could help me out here. What templates and variables are you using for your (DC) interface descriptions? What works for you and what's something that you clearly wanted to avoid?

​

Thanks in advance!

Juniper QFX SFP vs EX SFP

I have a Juniper QFX5100 switch. I have just purchased a Juniper EX-SFP-10GE-LR. Based on the Juniper documentation, it looks like this won't work in my QFX switch. Will this work? Even though its an EX-SFP vs QFX-SFP?

Cisco 2800 AP and poe+ injector

Wanted to share in case someone else stumbles across this. I am upgrading a number of APs from 1141s to 2800 APs. A good number of these APs are connected to switches that only support POE. Eventually these switches will get upgraded but for now we have to live with them. To get around the POE limit, we purchased some POE+ injectors from fs.com. When we first plugged them in, we noticed the Aps only negotiated to 15.4 watts for power and as such the radios wouldn't turn on. After a little bit of panic we figured out that we had to disable CDP and LLDP on the switchport to get the switch to stop advertising out its capabilities to the AP. Anyway if anyone else has this problem give this a shot and hope it works for you as well.

Throughput/Goodput in Node-to-Node messaging (Question)

Upon researching, from my own understanding, throughput is the "measurement of ALL data flowing through a link" and goodput is the "measurement of USEFUL data flowing through a link". Knowing this, can I apply this with something similar to text messaging?

For a general example, if I were to send a text message to my Dad, what would be the throughput and goodput in that situation?

-----

For a more specific example, I'm working on a type of mobile wireless messaging using Wi-Fi Direct on Android, if the message that I will be sending from one node to another is considered the "Data" of the throughput, does that mean that the goodput is if the message actually gets acknowledged by the destination node?
-----
Can someone kindly enlighten me, please?

How do you test a connection with telnet? Isn't having telnet open a security risk?

I'm a data center tech at the moment and I frequently hear engineers on calls saying how their are testing a new connection with telnet. How does that work exactly? Does the telnet port have to be open on the destination host? I would assume that is a security issue.

I tried telneting to a server in my lab and I was only able to pick up a SYN + destination host closed connection in Wireshark.

I would appreciate if someone could clear this up for me.

Agile! How is agile working out for your organization? Are you folks seeing any benefits?

No text found

Dell R640 to Nexus 5k VPC issue

Hey everyone,

Having an issue getting the VPC or port-channel to come up on the Nexus side. Two connected interfaces on the server side, split to a Nexus 5596UP stack. All of the VPC config matches perfectly. My only thought is that LACP and trunking have not been enabled on the server side, which is brand new. Thoughts?

Routing for DMZ to DMZ communication between sites?

I am trying to set up communication between two DMZs that exist in each of our data centers, and I am having a hard time wrapping my head around the routing logic required to make that happen. I have included a Visio of how the traffic I envision the traffic would flow between the two sites, but I'm having some trouble understanding how I can have traffic destined for a subnet, let's say 172.16.1.0/24 get to the firewall (in step 3 of the diagram) and also be routed properly over the DCI (in step 4). Getting the traffic to the Site A firewall is easy, but I'm missing something for the remainder of the path.

If I create a route on the Site A core switch to point traffic destined for 172.16.1.0/24 to the firewall, and then a route on the firewall to point the traffic back to the core router so that it can traverse the DCI over to Site B, that obviously won't work very well.

How would you handle this particular configuration? Switches are Juniper and firewalls are Palo Alto.

Quick ugly Visio of the topology and the traffic path: https://i.imgur.com/rvzGLfB.png

4 Fiber lines murged into 2 bigger fiber lines?

So I ran into something while I was going through our DC.

We have 2 separate cages in our DC, that are connected with a inter-dc link. This link is run over 4 strands of fiber to a patch panel in each cage. From the patch panel, these 4 2-strand cable run out individually, and then in the cable run are then merged into two thicker fiber cables (same on both sides) and then is delivered into one port of each of our Nexus 5k core switches. I've never seen this kind of in-line fiber merge before.

They are terminating on N55-M4Q cards in the Nexus (QSFP+ card), and each has 2 active channel/connections. Logically this all make sense, I've just never seen fiber merged on the fly like this previously.

I'm curious, is something like this normal?

MCSE or CCNP R&S

I currently hold CCNA, CEH, and Sec+. Work is paying for a boot camp of my choice. Not sure if I should go for ccnp or mcse.i enjoy working with both at work but I don't know which is more beneficial to pursue or is more beneficial to have. Should I concentrate on networking? Or build a more diverse skill set with an OS specific cert like windows.

Anyone ever been in a similar situation before? Not sure what would be best in the long run.

Cisco WLC and AP help

I've never had to set up WLC in my life until this week so I apologize in advance if this question is stupid BUT does a WLC need its own management VLAN or can I use my regular management vlan? I'll try to explain the set up as best as I can.

​

Core switch has a management Vlan 50 (10.50.50.x). I created a wireless vlan 100 (10.50.100.x) for the data. On the WLC I make the management vlan 50, the same as on my core switch. Connect the WLC to the core via trunk. Now when I try to get the AP to join the WLC, it gives me an error message saying something among the lines of wrong subnet/IP. The AP receives the correct IP from DHCP (10.50.100.5 in this example) and unless I tell the AP to send out a unicast to the WLC, it will not join.

​

What would be Cisco best practice in terms of setting up the WLC and AP? Should I create a separate management vlan for wireless (for example vlan 110 10.50.110.x) and have the AP and the WLC on that vlan?

Need advice. What is the industry standard to connect remote worker locations to multiple customers without having the customer build a tunnel for each employee?

Crude diagram here: https://i.imgur.com/U3QbVXM.png

FYI, not trying to do anything cheaply/free, just need to know best practice. All tunnels are IPSEC VPN tunnels and each employee is a remote worker.

Newbie to home networking. Need help deciding.

Sorry if this thread has already been posted. Just bought a new home and I had my builders pre wire all the rooms with cat6 cable. I want to know the big differences in 568A and 568B standards. My house is all ready keystoned to 568A. I’m getting ready to patch the cables to my patch panel. Should I take the extra time and re-keystone all my jacks to 568B? Will all my electronics work with 568B? Examples: smart tv’s, Xbox, ps4? I’m planing on doing all Ubiquiti equipment for my home network. Any thoughts are appreciated. Thank you.

Network Tools

What networking monitoring tool would everyone suggest? I work for a rural phone/internet/tv provider. Would like something that does graphing as well.

Port forwarding help!

Hello Everyone,

​

i am trying to forward port 1723. Setup is:

AT&T Pace PLC Modem/Router

Netgear Nighthawk R7800

​

I have forwarded the TCP/UDP ports on the nighthawk and set the Pace PLC modem/router to DMZ+ mode for the nighthawk R7800; However, when I check the port it is still closed. I have tried every solution I can think of. Please help!

​

I would prefer to disable the firewall on the Pace PLC modem/router completely, but it seems that is not an option. I have also tried to forward the ports directly on the Pace modem, but it says the ip's are not in the same family.

Ubiquiti NanoBeam M2 not broadcasting SSID in AP mode

Hey guys and gals, I’m having an issue with a nanobeam trying to set it up as an access point. We have a customer in our WISP network that has our service and is working just fine. We have a mini tp link switch in place. I’m just running into an issue with the SSID not broadcasting so phones or any device can see it. This was working previously before a storm hit and the other AP died. The guy before me had it set up and I’m not sure what he did to make it work. Any suggestions??

SC to LC Multi mode fiber connection issue when using FMC and SFP

Running Multi mode 1300nm (the 2km variety) fiber network. Have a bunch of fiber media converters (FMC) that take an dual SC connector and magically turns it into a ethernet connection. I recently purchased Trendnet TI-G102 switches with SFP ports and would like to directly connect to the MM fiber feed using Trendnet's MMFiber module TE100-MGBFX. These are all unmanaged devices, yet I don't get a link light when the fiber is connected. I made sure to run them TX > RX and RX> TX. I tried 62.5/125 and 50/125mm MM fiber patch panels, but to no avail.

​

However, I can go from one SC FMC to another SC FMC without issue as well as one LC SFP to another LC SFP without issue. So why not an SC to LC?

​

Is there some restriction that makes it difficult to go from an SC to LC connector?

​

Access modem web gui ? Technicolor E31T2V1 (posting here per Spectrum tech recommendation)

https://ift.tt/2zwr4Qw

Dealing with "Forced Policy Based Routing" requests

Hello Redditors,

Here's the scenario:

• Micro Datacenter provider (basically colo + internet transit using our own AS)
• We have multiple IP blocks both v4 and v6 that we lease to our customers (or they can bring theirs and we broadcast via BGP under our own AS or allow them to peer with us so they use theirs)
• We buy transit from 3 different major ISP (lets call them A, B, and C) and are also connected to 1 IX

All normal so far, the problem is, lately I've getting the following kind of requests that management wants applied no matter what:

• Customer A, owner of 192.168.0.0/24, wants all of 192.168.0.0/24 traffic to be sent only through ISP-A
• Customer B, owner of 192.168.1.0/24, wants all of 192.168.1.0/24 traffic to be sent only through ISP-B and ISP-C

If it was incoming traffic, no major issues, a combination of prepending or directly selectively withdrawing the prefixes would do the trick, but this is outbound traffic, for very specific subnets. Which the network was never meant to do, thus now we have the situation were I'm getting forced to do PBR routes on every single hop in our edge, to achieve what they want. I've tried to explain all the risks involved with this, specially considering the fact that I have to keep messing with key devices to get this done, but so far, they just say "make it work, the customer wants it".

It's not that we don't optimize the outgoing traffic, we actually keep monitoring and paying attention to latency or loss complains to adapt our global routing policies. Is that specific customers wants for whatever reason to use only a specific transit outbound.

Have you dealt with this before? what was your way to making management understand we must stop accepting those requests until the network is purpose built for such things?

I've also been thinking lately on how to achieve this, quick, simple and cleanly. So far my ideas are:

1. Use a single edge router for each ISP (those routers will never peer with each other and will always prefer the local ISP routes) and then use "service routers" that our customers connect to, and do all the policy based routing in those service routers. Problem is the amount of peering we will need on each edge, can't use route-reflectors here, they'll then select the best route and we need to do that independantly on each service router
2. Tell customers to gtfo because we're a transit with internal routing policies and if they want a specific transit outbound they should peer with them directly (yeah, bad business option...)
3. Option number one but using VRFs so I can have multiple routes active by using different RDs (ISP-01 RD 65500:1, ISP-02 RD 65500-2, and so on). This allows me to use a RR

Is there any other way? am I overthinking this? do take into account that I know I'm not providing any network topology, so what I want to know is a way to achieve this by a redesign.

Netflix and Amazon Prime Video think my org is a vpn?

I'm a network admin for a mid-sized public school system. We have about 6500 users natted behind 8 or so IPs. My users at our largest sites are getting blocked when they try to stream video from Netflix or Prime with error messages that basically say, stop using a vpn.

I'm assuming this is because of the number of connections coming from a single address. And there is some kind of automatic blocking on the streaming sites end. I did some quick google-fu and even chatted with a basic support rep at Amazon but I can't get anywhere.

Does anyone know how I would get these sites to unblock our IP block? Or how to reach out to an actual admin over there instead of a customer support rep?

Network Plan for Startup with IP-Based Production

Full disclosure, I'm not a network engineer, I have a degree in Telecomm, but it's been a decade since I wrote a routing table. However, I'm currently working for a couple startups and as anyone in the startup world knows, you just gotta figure some things out sometimes.

​

The network I'm trying to build is pretty straightforward with one exception, we do IP based production and I need a 10G copper network for that VLAN specifically (that can also talk to the Wireless VLAN). (We're doing a lot of IP-based production)

​

I've mapped it all out here in LucidCharts. I was just hoping to get some advice on products that work well together and can achieve this, and also be as cost effective as possible.

​

I was going to try to stack Netgear's PROSAFE 10GB switch with their PROSAFE 1GB switch but they couldn't really tell me if they stacked and I could configure them as one; plus neither supported POE for my APs. I've also heard Brocade stuff is good and reasonable, but I haven't found a good 10GB copper switch

​

For the APs I was planning on Ubiquiti's Unifi solution, since I don't have to pay for a cloud subscription; but I know Netgear has a similar offering, everyone else at this point I'm sure. I've heard great things about Cisco's Meraki, but I also heard you have to pay a monthly fee for their cloud mgmt. I've just worked with Ubquiti before, but if there's something better I'm all ears.

​

Really I was kinda looking for an all unified solution, but I don't think one exists yet. So I'm kinda just asking "What would you do" for this kind of setup. Looking to get hardware recommendations and any advice the community would be willing to share.

​

Thanks,

​

TumTum

Subnet scheme for transit networks best practices

Hi All,

We are beginning to move away from large layer 2 networks and spanned vlans at our sites. I am looking for suggestions on subnet choice for the new /30 transit networks we will have. So right now for our devices, clients, servers we assign a 10.X.0.0/16 to each of our locations and subnet that into multiple /24's and smaller. For transit L3 interfaces I assume it is best to use networks outside of that /16. Would it be a good idea to dedicate a /24 range at each site for transit use? Such as 10.8.1.0/24 for Site 1, 10.8.2.0/24 for Site 2. Site 1 transit network 1 is 10.8.1.0/30. Transit network 2 is 10.8.1.4/30 etc etc. Any suggestion would be appreciated, we are just trying to make growth easier and avoid future headaches.

Need Help determining which switch traffic is flowing through

I have a Hyper-V guest that has 2 vNICs on 2 different subnets, both on the same VLAN ID 2 within a virtual switch.

The host that the guest resides on has direct connections to a SAN switch and a server switch that contain the 2 subnets, the SAN switch communicates on VLAN 1, the server switch on VLAN 2.

What I cannot determine at the moment is how the guest is able to communicate to the SAN considering the vSwitch it's on is using VLAN 2 not VLAN 1 and I cannot tell which physical switch the guests packets are flowing through.

​

I have tried tracert (shows next hop is the destination)

I have tried netstat (shows on-link, so direct connection)

I have tried Wireshark; however, I am not certain exactly what to look for with packet flow, when I do an ICMP request it simply shows the source and destination but not the path of how it gets there (i.e. which physical switch)

​

Anyone have any ideas?

​

Cisco [NX-OS] Port Number Names?

Is there anywhere a full list of all the port numbers that a Cisco device (Nexus switch in particular) will use in place of a numeric value in an access list?

​

For example if I configure the following ACL:

ip access-list TEST permit tcp any any eq 80 permit tcp any any eq 443 

​

When I look at the running config it is represented like this:

ip access-list TEST 10 permit tcp any any eq www 20 permit tcp any any eq 443 

​

The "80" has been replaced by WWW. I know it uses the official IANA port names (as defined at here,) however it doesn't use them all, for instance it doesn't replace '443' with 'HTTPS'.

​

I am automating our access-control lists using NX-API REST and it also returns the textual form of port numbers. To ensure consistency I have to convert the textual form back to numeric where appropriate, but I don't know where I can find a full list. I could of course create an ACL and try to add every single port number, but perhaps someone knows where a definitive list is available?

​

DWDM over 140km DF?

We are looking at getting a DF pair over 140km. We'd like to run a handful of 10G circuits over it. It seems like a passive mux/demux with pre-amplifier tops out at around 120km (fs.com) - is our only option to get it regen'd along the path? My knowledge of long haul fiber runs is a bit lacking.

Assigned carrier address space - can I use a .0?

I was assigned a /28 from a carrier as additional NAT address space. I've used everything from .1 - .15, but not .0. I've never tried this before, but would it be possible to have a host use the .0 address?

On a LAN where it's a broadcast domain I wouldn't bother trying, but this would be a pure routed solution. Seeing as how I have already assigned and used the "broadcast" address of the subnet, that's where I'm coming from and questioning whether I can use the network address.

Stable Code Version for the 3750-X

Hello,

We're running a couple of stacks of 3750-Xs that reload more often than we'd like due too a memory allocation bug seemingly caused by the HQM Stack Process. We're currently running 12.2.(58)SE2. We're looking for a stable code base for stacking, IP ACLs and a very basic L2 feature set (vlans, port channels, port security). We're opening a case with Cisco to get a recommendation as well but we're curious what /r/networking recommends as a stable version for this platform.

TLDR; post your best uptimes and code version for your Cisco 3750-X switches.

Thanks!

Cisco ISE 2.4 Alarm Issues

It appears that the standard ISE 2.4 install comes pre-populated with 179 different Alarms, all of which are, by default, enabled and set to send syslog messages. Is there a way that I'm not seeing to make mass edits to these alarms or am I going to have to edit every single alarm individually to either disable the whole alarm or set it not to send a syslog message to my log collector?

If that latter, that's absurd. How hard is it for Cisco to just implement a check box at the top of the list to Select All -> Enable or Disable?

Spine/Leaf Management Tools

Hi all,

I am curious what people are using to manage and deploy spine/leaf fabrics. The only thing I've seen is CORD, but even that doesn't look like its for deployment, more just statistics. Currently everything is done via CLI, but I'm hoping to automate some deployment with SDN.

​

​

Anything you know about the two generals problem...people who have theorized about it, I’m looking for stuff not available in Wikipedia. Thanks.

I don’t know a ton about networking obviously but I’m looking for people or articles, etc. that have attempted to approach this problem, or just ponder it from a theoretical perspective. Thx

need help on dual homing switches

We're upgrading our core and the old one has our access-layer switches dual homed: 2 different vlans going to 2 different cores. The new (hp) core is running vsf (2 cores but logically 1). Since we're not yet upgrading the access layer switches, we'll probably stay with the old (at least 7 yo) design. We can't do etherchannel/trunk since a lot of the links we have are different speeds and i haven't had luck getting 2 brands to work (hp and alcatel). Is there a potential flaw/risk in this kind of design? If so what would be an alternative?

SPF to RJ45 WAN Network question

Hello,

Our office is moving very soon to a new location, and since I have been the one with the most networking experience, the whole issue has been moved to me.

Now I have ordered us some router & switches that are user-friendly enough that if I ever need to pass it on, they don't need a cisco cert to understand the basics. In light of this, I ordered Cisco Meraki MX84 & 2x MS210.

Since the new building owner also doesn't provide any Internet connection, I was left out shopping for this as well. Now long story short, we found a well priced ISP and they provided us with a neat set of static IPs and hooked us up to wide Internet.

Now, this is where the issue comes in.

The email I got from the ISP said the following: "we have connected the fibre and added an SFP 10GBASE to the line". This is pretty cool, until it hit me, the MX84 has SFP ports, but they can't be used for WAN, the WAN port is RJ45 only.

The SFP device is the following: https://imgur.com/a/xKvrFTL - which is an SFP or SFP+ device? This confuses me, as I'm finding it hard to find any information if there's actually any physical difference between the those plugs.

So, given a nice little headache and me going back to thinking about how I can solve this. In comes my idea of "Fuck this, we're moving soon, I'll deal with the overhead later".

Option 1)

Plug the SFP plug into the switch SFP port (49) put that port on VLAN ACCESS 666, wire copper (CAT6A) from port 48 (VLAN TRUNK 666) to the router WAN port. WAN on the router is set to one of our static IPs, and VLAN 666.

Disadvantage: we run from switch back to router, to go eventually back to switch to the clients.

Option 2)

Plug the SFP plug into the router SFP port (11) put that on VLAN ACCESS 666 and assign it a static IP address from one of the subnet which we received, run a copper cable from one of the router's RJ45 ports to the WAN input, putting that port in trunk 666.

Disadvantage: we're already losing 1 static IP just to give that SFP port an IP.

Option 3)

Call some store, order at the speed of lighting a media converter.

Disadvantage: it's ugly, it costs more money, it might not arrive in time (putting 50 developers without Internet for a few days)...

I'm inclined to go for option 1 as we have the overhead on that solution: ISP -> Switch -> Router -> Switch -> Client, but at least we're not losing anything (static IPs, money on media converters, ...)

Finally, this link is 5 Gbps which was ordered from the ISP, and our devices can currently (we're adding more devices later on) only handle 1Gbit SFP, will this be an issue as well? If it is, all my solutions are void and I'm fucked anyway:-)))).

The goal is to run option 1, until we complete the upgrade of the network, at which point I can order MX250s and just plug the SFP directly into the WAN SFP+ port of the MX250.

Any help would be much appreciated (and thanks for sticking with me till the end).

Hoder

SPAN into Cisco ACI (not within)

Hello,

Hopefully someone can point me in the right direction. In summary I'm trying to get external (to ACI) SPAN traffic into a VM that happens to sit behind ACI network (VMM dom).

So far I've got an EPG that consists of a physical dom linking the external b-leaf port accepting the SPAN traffic and of course the correct VMM dom to the VM with Promiscuous mode is enabled.

However I'm not seeing any of the SPAN'd traffic hit the VM.
From the EPG -> Operational TAB I can see that ACI has all the mac addressing as expected for the BD.

If any one has done similar or has any pointers please let me know?

Regards,

TC4

​

Cisco "Mesh" Network Help

We've been in our new building with brand new, (supposedly) top-of-the-line networking equipment for about 6 months now. We have a Cisco 5520 Wireless Controller, Cisco Switches, Routers, and FWs, and 22 3800i APs spread across 32,000 sq ft. Many of these APs are only 30 feet from each other. Our wireless network is currently configured with all of the APs having the same SSIDs, but it's not set up for roaming to work. As someone walks around the office they will lose SAP sessions as they transition from one AP to another. If someone walks really far from the AP they are currently connected to but not so far that they disconnect, they will stay connected to that AP and get terrible speeds because of the distance, instead of getting switched to a closer AP. Because of this, users often manually turn their wifi off and then on to get connected to closer APs.

​

Our networking guy has not been the most prompt about resolving any network issues and has gotten a lot of pressure to resolve these things for months now. It seems all we get back are excuses. He says that creating a mesh/roaming/star (really not sure what it's called in the Cisco world) is going to require more equipment and licenses. More money

​

Is he correct? Do we really have to spend more money, whether on more hardware or licenses, to make it so our 5520 and APs are configured in some sort of mesh network that allows for roaming without dropped sessions and always being conneced to AP with the best signal? If he's incorrect, can anyone advise on a guide that could be used by a couple guys that have previous experience setting up basic networks and using Cisco IOS, but are by no means Cisco or network pros, to transition our wireless network to mesh?

​

Thank you!

secure intranet with power line carrier (PCL) ?

Hi, I would like to know whether there's viable safe options on the market in order to create an LAN intranet without any connection to the Internet for internal IM & communication. I've asked about software elsewhere but I think I'll stick with Retroshare, as it functions on p2p without central server.

I don't want to link the individual post to the local ethernet wiring for fear of hacking, so i wanted to know whether this could be a safe alternative ? Maybe there's special anti-hacking hard-or software available for PCL ?

I guess I'll need some of there right :

https://www.amazon.fr/TP-Link-Ports-Ethernet-Gigabit-Int%C3%A9gr%C3%A9e/dp/B06ZYJSV5M/ref=sr_1_1?ie=UTF8&qid=1537962863&sr=8-1&keywords=courant+porteur+en+ligne

UK WAN Provider

So our MPLS WAN contract is up for renewal. We have a small netowrk of 100+ sites spread over the UK and Europe. We are looking at our options and so far are underwhelmed by what our suppliers are offering so I am looking for recommendation for managed WAN provider, or recommendations for who to avoid.

Current offerings is just re-enter contract with existing supplier (not something we want) or they've offered us a solution using Meraki hardware.

As it is a managed solution I don't mind what hardware they are using as long as we have the relevant SLAs etc but from reading reviews of Meraki it seems it may not be the best for the price.

Is there anyone out there who can recommend a good provider who they have experience of using that aren't a complete nightmare to deal with? (if these even exist!)

Differences Between APC NetShelter Models?

I’ve read some good posts on APC NetShelters here but I’m a bit lost on exactly what differentiates some of the models.

I’m looking at 42u units in 1070mm depth, and I can see that there’s the AR3140 for $2,250 and then the AR3150 for $1,650. They seem to have the same dimensions, and the only difference I can see in the specs is that the 3150 has a slightly higher max mounting depth and a slightly lower minimum mounting depth.

Other than that, I’m lost. So could anyone fill me in on what other differences there might be, and why one might pick the 3140 over the 3150?

Data more than MSS size

What will happen to data according to nagle's algo , if the data to be sent is bigger in size than the available MSS ?

PCF on AWS Questions/Challanges

Whats the proper way of setting up PCF on AWS, and dealing with the issues of IP white listing.

Any guide, tut or book related to this.

Boardroom and Av Integration Items at Data Networking Gauteng

For widely uses in corporate houses business enterprises, institutions and many more Matoto Data networking Company is providing excellent Boardroom and AV Integration items with a smart manner. For more details you can contact at 011 056 5042 and visit online website for any help. www.matoto.co.za

​

Data Center Bridging - need some help...

Just to preface this - i've raised calls with both Microsoft and Dell and read the documentation extensively but I don't seem to be getting very far. Hoping someone who has real world experience of this could offer some insight...

We have a Hyper-V cluster supported by a pair of Dell s4048T switches. Each host has 4 NICs, 2 of these will be dedicated to ISCSI so the DCB element is only required on the remaining two which will run all cluster and server traffic. We're looking to use ETS to allocate bandwidth to certain traffic types over the non ISCSI pair of NICS, specifically live migration and cluster, with a default for everything else. My config is below

On each cluster node

Get-NetQOSTrafficClass

Name Algorithm Bandwidth(%) Priority PolicySet IfIndex --------- ------------ -------- --------- ------- ------- [Default] ETS 45 0-2,5-7 Global LiveMigration ETS 50 3 Global Cluster ETS 5 4 Global 

Get-NetQOSPolicy

Name : Cluster Owner : Group Policy (Machine) NetworkProfile : All Precedence : 127 Template : Cluster JobObject : PriorityValue : 4 Name : Default Owner : Group Policy (Machine) NetworkProfile : All Precedence : 127 Template : Default JobObject : PriorityValue : 0 Name : LiveMigration Owner : Group Policy (Machine) NetworkProfile : All Precedence : 127 Template : LiveMigration JobObject : PriorityValue : 3 

Additionally - QOS is disabled for the iscsi adapters and enabled for the remaining.

Switch Config

service-class dynamic dot1p dcb enable dcb-map SET priority-group 1 bandwidth 50 pfc off priority-group 2 bandwidth 45 pfc off priority-group 3 bandwidth 5 pfc off priority-pgid 2 2 2 1 3 2 2 2 

Each interface connecting to the hosts (non iscsi) nics then has the dcb-map assigned.

Testing

The reason I don't think it's working is that when testing, the live migration is saturating the link. For example, if I live migrate 5 VMs and move a large (30GB) file simultaneously, the fire transfer speed drops to a fraction of the link speed until the live migration has finished. If I amend the percentages to be in favour of default traffic with a 95/5 split, the same behaviour occurs.

​

I feel like i'm misunderstanding something fundamental about how DCB works or how this should be configured, can anyone offer any input?

​

Recommended Reading for Campus Network Design?

Hey guys, I apologise if this isn't allowed here or I've not displayed enough effort to warrant an educational question.

I'm just heading into my final year my degree programme and my project involves evaluating network technology within a model I've to create of a medium-sized campus network in Riverbed Modeller/OPNET. I intend to evaluate the performance of EIGRP and OSPF within this model and implement a routed access layer in an attempt to make it more modern and help it stand out a bit more. My biggest obstacle I believe will be the design and creation of this model as my results (and by extension my paper) will be garbage if it's not fit for purpose - so I'm looking to see if you gents have any other recommended reading on the topic.

My library has 3 Cisco books I'll be checking out: Designing Cisco Network Services (ARCH) Implementing Cisco Switched Networks (SWITCH) Designing for Cisco Internetwork Solutions (DESIGN)

Just checking if anyone has any recommendations or tips outwith these books and whatever design documents are available on the Cisco website. I'm eager to do well, but not have anyone do it for me, so any pointers in the right direction would be greatly appreciated.

Shopping around for Cisco quotes

We are looking for a couple of new switches for our DC, historically we always use the same Cisco Gold Partner for our purchases.

​

Just wondering, is there any price advantage to be had by shopping around or are discounts offered by partners pretty much consistent?

Sanity check: Network rework with 2x1G uplinks for access layer?

Hello everyone,

​

it's been a while since I've been mainly doing networking, right now I'm working more on the infrastructure side of things (VMware / Backup / Monitoring / Storage). At my old job, I was doing a complete rework of the network to up to date Cisco gear and every access switch, even a single 48 port, received a 2x10G LAG uplink to the distribution/core layer.

​

Now at my new job, where it's none of my business and I was not included in any of the meetings regarding concept, they went with a concept where single switches and sometimes even stacks with two 48 port switches only received a 2x1G uplink. They said, the partner they decided to go with for this project said that having 2x10G is completely overkill for every access switch and is only required in particular areas.

​

My issue with this is though: If my math did not let me down, a 48 port switch would only have 40 Mbit/s available per port, a stack with 96 ports would only have 20 Mbit/s available. That sounds simply insane to me, especially considering that the only limiting factors are the transceivers and they're not so much different in cost.

​

Can you tell me if this is actually a valid thing to do? Is that the correct way to save money? Because I really think it's not.