Nexus vs QFX

We have been planning to purchase a pair of QFX5120's as part of a datacenter build / migration. However we have been having some issues with our SRX4100 cluster and TAC has been pretty bad. Frankly or experience with Junipers TAC has been pretty bad over all, very time consuming and rarely a real solution. So far all of our experience has been with the SRX and EX platforms. This has pretty badly shaken or faith in Juniper as a solution for our datacenter, as we will not have immediate physical access to the devices. As such have almost decided to go Cisco Nexus 93180 as in general our experience with Cisco TAC has been much better.

I'm curious if the QFX series devices bring anything that great to the table that we should still consider them? Overall I prefer the Junos OS CLI to Cisco's various flavors, but the number of errors that require physical access to clear is off putting.

Windows 10 fails to use correct source address with "ping -S"

I was doing some troubleshooting with a Windows 10 system and discovered that the ping -S argument, which is supposed to specify the source address used in the ping, is not working correctly.

If I do this:

C:\WINDOWS\system32>ping -S 1.2.3.4 10.0.0.8 Pinging 10.0.0.8 from 1.2.3.4 with 32 bytes of data: 

But then do a tcpdump on my nearby router, it's using the wrong address as the source for the ping.

some-firewall:~$ sudo /usr/sbin/tcpdump -n -i eth1 dst 10.0.0.8 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth1, link-type EN10MB (Ethernet), capture size 262144 bytes 19:19:12.654581 IP 1.2.3.101 > 10.0.0.8: ICMP echo request, id 1, seq 94, length 40 19:19:17.176845 IP 1.2.3.101 > 10.0.0.8: ICMP echo request, id 1, seq 95, length 40 

Fucking Windows.

The system has two IP addresses assigned on it's single network interface. Inbound connections to that secondary IP work fine.

Layer 3 fabric with no overlay?

So as I understand it the new trend in data center networking is to use a layer 3 fabric with an IGP as an underlay—often with “ip unnumbered” peering—and then use an Overlay Network like VXLAN with EVPN Control Plane on top of it. This can allow you to use the same subnet at different “pods” in the network... or even different data centers, without the need to stretch layer 2 domain. Also it allows for total cookie cutter builds like every leaf switch having the exact same config other than mgmt ip and host name.

My question is this. Has anyone tried a layer 3 fabric build without using an overlay via server-side bgp with /32 network advertisements?

In theory it should achieve the exact same connectivity without the need to run multicast, VXLAN encapsulation, or EVPN config.

I haven’t seen a setup like this in practice though so I don’t know if that makes the configuration more complex on the network side of things. Usually bgp requires static peer configuration so I’m not sure how ugly that looks. I know you can do “dynamic listener” for bgp but that may be pretty far from a best practice.

Alternatively you could not use BGP and just have the servers be an IGP node.

Anyway my question is has anyone seen this setup in production? Servers advertise a /32 for every virtual machine instead of using VXLAN/EVPN. Everything’s layer 3 everywhere. Any layer 2 is basically link local.

How is such a configuration set up? How does it scale versus VXLAN/EVPN? How friendly for automation and auto provisioning? How is the TCO versus overlay alternatives? Maintenance/Troubleshooting? Challenges/gotchas?

Gateways on Core Switch vs Firewall

I’m struggling with some design options for a network redesign I’m planning at my company.

The background: Today I’m running a relatively simple network topology. Firewall/Router on a stick. All layer 2 switching, no layer 3 switching at all. All inter-VLAN/L3 routing happens on my firewall.

I recently purchased (2) Nexus 93180YC. I’d like to make these my redundant core switches.

My internal debate is this: Keep my gateways on the firewall/router and continue to do inter-VLAN routing there OR create SVIs on the Nexus switches, make those my gateways and have them handle all L3 routing.

Both approaches have pros and cons…

Today my current firewall/router on a stick model is fine as we don’t have speed issues for most traffic. The main issue is I want to give all VLANs high speed access to a few NAS storage devices. If the NAS traffic has to flow through my FW it would not be fast enough for users to do their work (video editors).

With all of that said, is there another approach I’m missing here? Maybe something to do with VRFs (admittedly I haven’t dealt much with VRFs previously) Is there a way to keep the best of both worlds… i.e. still manage the vast majority of inter-VLAN rules on my FW instead of using ACLs while still being able to provide devices in all VLANs high speed NAS access.

Perhaps a way to tell the Nexus route table to route all traffic except for the NAS traffic to my FW?

I’m open to any and all ideas!

Thanks!

Remote port mirror to JATP Vcollector

Hello Guys,

I have a Vcollector in an ESXI and I want to span the VLAN 10 traffic to it.

I checked the remote mirror configuration by it's not really my scenario since my source must be a VLAN not a physical interface and the output must be an IP. Can somebody help me with the configuration?

​

set ethernet-switching-options analyzer employee-monitor input ingress ???

set ethernet-switching-options analyzer employee-monitor input egress ???

​

set ethernet-switching-options analyzer employee-monitor output ip-address 10.99.99.99/32

​

thanks

ISP connections into a VLAN

I wanted to get the opinions on reddit with some details to back it up. Does anyone put their ISP connection onto your network switches in their own vlan that also share your private networks? Not using your switch to nat/route, still using your firewall for that.

Example

Vlan 69 ISP1 Vlan 79 ISP2 Vlan 150 DMZ Vlan 200 servers Vlan 205 Users

Mostly looking for Pro/Cons, security risks, stability etc.

one ethernet cable, split into two ethernet jacks

Hello :) quick question. Is it possible to use one ethernet cable to make us of two ethernet jacks?. Have a double ethernet jack wall mount laying around which i am going to hook up at my nephew's place. He is only 8 years old and doesn't need any crazy speeds, so if the speed would drop from gigabit to 100/100 that really doesn't mather. I am kinda having a bit OCD of having two ethernet jacks but only one functioning port, and dragging a secound cable is out of the question.

Picture of the wall mount i got. https://imgur.com/ySEGrwF

Any good resources to learn about networking more in depth?

I already know the basics of how UDP/TCP sockets or HTTP requests work, but I'd like to learn more about specific client-server architectures, how to handle the connections on a MMO, turn-based game, co-op game, how to interpolate the movement of characters in a real-time game, how to create scalable projects involving networking and stuff like that, because I'm honestly having troubles programming the logic between the client and the server.

It was all nice and fun when all I had to do was a console chat or a Tic Tac Toe game, but I'm starting to feel the need of some design patterns.

Any form of help is highly appreciated! Thanks in advance!

Your biggest network challenge?

I'm working on developing a thesis topic for my dissertation in the next couple of years. I would like to to see what all of you see as the biggest challenge currently in the networking world as far as security goes? What do you think the future is going to bring as far as more challenges and potential solutions?

I think the idea of the number of devices outgrowing our infrastructure is a real concern. With this, shortcuts will be taken in the short term I believe.

Seeking help, network/cloud bottleneck?

This has been a long going thing. So I have only laptops. Surface Pro and a Macbook Pro. At work, this is never an issue but something about my computers and networks outside work is. I've been trying to consolidate my cloud files but the drives always "time out" making this IMPOSSIBLE.

​

When I try to access OneDrive, iCloud, or WesternDigital's online thing, I always get MAJOR slowdown when loading the file locations. When I launch the apps from my desktop on Mac or PC, they struggle to load even thumbnails. Arranging files, dragging and dropping to and from, out of the question. It performs just like dial up. I'd try to take an action like right clicking then and wait several minutes for it to catch up.

​

At first I thought it was my router and modem (because even my NAS would slow down) but I've since relocated and got all new router and modems. These are top of the line stuff so I'm ruling them out. At this point is it safe to say it's my computers? My Surface Pro is maybe 2 years old though with 8GB of RAM on 1909. At work, on work laptop, I can't use the software but using the website version it works smoothly so I know my files aren't corrupted or anything.

​

This is what I get when I try to do anything using files in the cloud like OneDrive, iCloud, and MyHome on my computers. The green bar at the top STALLS OUT like a dial up connection. The entire drive will lock up and become unresponsive no matter what I do. I reboot, check for updates, everything. I just can't get it to work and it's been this way for months.

I gave up trying to edit them while they're in the cloud. My new plan was to just download everything from the cloud, put them on an external, delete the cloud, and reupload once I had my external files organized but now I can't even do that. This is the message I get but overall everything just stops.

​

https://i.imgur.com/97xd8wU.png

Uplink switches to a core or firewall

Designing a small network with 4 switches and trying to determine most effective method for connecting these. My original idea was to uplink switches directly to the firewall since there are enough ports for this. All switches and firewall are in the same room. Another idea was to use a core switch and uplink all switches here.

What’s the recommended setup for this scenario that will provide best performance?

Network segmentation project

I would like to know if anyone here already run a network segmentation project. If so, what were the pros and cons of the project and what are the results afterwards and how long did it take for the project to be completed? Thanks!

Raspberry pi OpenWrt - assigning static ip failed

I'm trying to assign static ip (192.168.2.1) for my raspberry pi when connect to router via lan but sounds like my router doesnt allow any ips over the gateway range 192.168.1.(1-255). Any method to allow this ?

​

raspberry pi 4B

ZXHN H168N V3.1

Aruba Beacons as iBeacons, without Meridian

I've been trying to set up some Aruba Beacons as iBeacons, without having to get Meridian (I have no idea even how to get Meridian). All I can find is this:

https://www.reddit.com/r/networking/comments/az68un/aruba_beacons/eiezsj4/

They do “beacon” out of the box and if you had a BLE scanner you could find the UUID/maj./min.

However, I've tried two out of this five-pack and, despite the batteries being good, my scanner shows nothing. I've tried short and long presses of the reset button, but nothing.

There is no instruction leaflet in the box, and Aruba's site is long on marketing information and short on instructions — the best I could find suggested using their own Aruba Beacons app, but that requires a login that I don't have, and doesn't say how to get one.

Is it possible to use these as plain iBeacons without having an Aruba enterprise setup?

Thanks

Meraki Switch Alternatives

Let me start by saying I love Meraki (at least for the purposes of our business) — Management is pushing me to replace as the licensing (in their eyes) is becoming more and more expensive.

We are almost entirely Meraki, which is annoying they want to move from it. Either way, I am always open to new solutions, with a single item, I don’t find negotiable. My team uses the management panel, especially the current clients and IP of the devices plugged into the port. I haven’t seen any other switch that provides this EXACT functionality. Yes, I know you can see MAC address or packet capture, but none of them are as easy or simple.

Are their other management systems that provide this?

MTO/MTP Cable Layout & Options

I'm looking at our options going forward over the next 10 years with regards to our network. (We are a growing school campus, currently with 7 buildings on roughly a 0.5km x 0.5km estate. Our main building sits directly in the middle with main switch room and secondary switch room in this building)

We currently run a 10G backbone that has been the bottleneck between our servers and clients since before I started. I would like to upgrade to a 100G backbone eventually so we are hopefully ahead of anything that happens going forward. Short term, however, I believe 40G would be more than sufficient given the technologies available.

I am therefore looking at replacing or re-splicing the fibre we currently have installed - I know is it multi-mode due to the transceivers we have, but I don't currently know any more about which type of fibre it is because it is just in a black casing with no discernible writing/markings.

TLDR skip here:

We have an MSP that will do most of this but I generally find that they tend to try and fob us off with the easiest solution for them, not the best for us...

Therefore:

1. I am assuming that my best bet moving forward for 100G links would be to have MTP/MTO cabling installed that way if needed I can use a break-out cable but most 100G devices will accept the cable directly?
2. I am of the understanding that MTO is male-female, therefore do you have specific patch panels that are female to female (which I have not yet found any of)? Or does your transceiver have an adaptor that accepts both?
3. When is it appropriate to use Up-Up versus Up-Down, how would you recommend keeping track of which end of the cable you are on (if the cables run into patch panels)?
4. Would it be better having something like a high density of LC connectors installed instead of the MTO, and connecting any 100G devices to 6 of the LC patch ports (though rack space in the main server room is extremely limited)?
5. I've read that MM MTO cable is limited to either 70m or 300m, which one is true and therefore would it be better, in your opinion, to push for SM or MM fibre to be installed for the long term? Knowing that SM will be more expensive...

Thanks for any advice - I have only ever dealt with 10G fibre so this is largely a whole new world, any required reading you could recommend would be great too!

High Ping with Gigabyte Ethernet!! Please Help

Past 3 months I've been trying really hard to fix my ping issues. I've switched to gigabyte plan(Cox), bought a new DOCSIS 3.1 modem, and router that supports gigabyte ethernet. As a result, I have ~600 Mbps download and ~35 uploads, but my ping still won't go down. In League of Legends, I get 150+ ping 9 out of 10 times and the same goes for other games.

Here are some data for you guys to help me out: PingPlotter, google.com ping, and fast.com speed test. Please Help!!!

https://imgur.com/QJPR3A6 - PingPlotter test

https://imgur.com/nkc7zaP - Google.com ping(cmd)

https://imgur.com/OK4X6H5 - Fast.com test

Help !!

I've just rested my router and can't get the IP address for changing the SSID and password, I tried the default IP address 192.168.1.1 but not working

Please help !

Small Business: Running 100MB router

Looking for some advice on a new router, just started at this job and have noticed our internet is dog shit.

They're still using a 100mbit router: https://www.cnet.com/products/dell-sonicwall-tz-100-security-appliance-series/

I want to help these guys out, we get horrid internet speeds. We're a lighting company, and most of our business is done over email.

Looking for some advice, does anyone know of a gigabit router with wifi that would help us out?

Using spectrum phones, wifi would help also, they're running wireless G......

Subnet Mask question

I'm just starting my networking journey and I'm confused. 

If I have an network range of 172.19.254.0 /27, when I enter it into a router I get a subnet mask of 255.255.255.0. I thought 172 was a class B which would be a 255.255.0.0. Does the /27 dictate subnet mask rather than class? I also get more than 30 IP's in the pool. Thank you in advance for your time.

Interested in networking field but unsure too

So I just finished high school and started a ICT course, the thing is, my course is focused on being a help desk manager for ICT related things etc which is something I'm not interested in (https://www.cput.ac.za/academic/faculties/informaticsdesign/prospectus/course?i=453&seo=SEM6IEluZm9ybWF0aW9uICYgQ29tbXVuaWNhdGlvbiBUZWNobm9sb2d5) It has ICT fundamentals, web dev, some programming, communication and ITSM.

Im looking at the networking field and I think I want to go this route instead, there is a 1 year course and I'm not sure whether to switch to this or not (https://www.northlink.co.za/course/it-pc-technician-network/)

Also, what certifications would be good to have and is there anything I need to know about this field? What does a day in the life entail etc. Any help would be appreciated.

Thanks

8p8c on one end (ONT) and keystone jack on other?

I've wired a Fios ONT to my router temporarily via a cat6 cable with a 8p8c connector on both ends, but I have a hole in my wall. I'd like to install a keystone jack on the wall to pretty it up a bit. The cable is T568B at both ends currently. What scheme do I use to replace the one 8p8c end with a keystone jack? Type B as well?

Aruba Multicast VxLAN?

Started a new job with mostly Aruba so I'm a bit wet behind the ears with their equipment. But according to their documentation, all the VxLAN stuff is in their Advanced Routing guides and I don't see mention of multicast VxLAN. Instead, it's unicast, which causes full mesh configs and adds complexity to the configs. Anyone know differently if multicast VxLAN is supported or it's a feature coming down the road?

IPSec vs Key Escrow

Hi, we have a new branch office located in another country and the gouvernment there is asking us to give our encryption Keys (psk) in order to obtain the appropriate permit to exploit encryption software/Hardware. We must give them the Keys, we have no choice. How can we protect our internal network from threats if we give them the key? We are going to use two ASA gateways in site A and B. Openvpn over IPSEC can help in this case?

Remote access to government computers

I work for a local government. I sometimes work from home with a gov-owned laptop and am allowed to VPN into the local network. However, due to the nature of my work, it would be far better to have a remote connection to a computer that remains physically on the local network, therefore having full-speed access to local databases. I'm not posting to discuss the merits of VPN vs. RDP (or any other remote protocol).

The problem is my IT department either can't or won't allow a remote connection, due to (they claim) gov regulations out of their control, security, licensing, etc. I'm not convinced it's not actually due to simple ineptitude or unwillingness to change. So my question is whether anyone here works for a government that does allow remote connections, and any details you might be able to provide about how it works.

Thank you!

Anyone expert with vWaas and cisco routers ?

I'm looking for someone here who can guide me and clarify some steps.

​

​

Thank you.

Anyone know a place to sell older equipment? (Besides Ebay)

Long story short we have a variety of older networking equipment...(Some other stuff too) From Really old worth a couple of bucks to maybe worth a bit more. (8 12600 checkpoints. They still work well.)

Bosses said we can sell them for whatever and it can get pooled to a department "whatever/fun pool"

Anyone know of a service other than e-bay that does this? I don't want to be spending a lot of time mucking about etc, but also like to sell some of this stuff for near what it's worth. (Of which I have no idea what it's worth.)

Thanks for the help.

Two very basic question on DHCP relay agent?

Hi guys, again inquiring about DHCP (sorry !). Just to confirm and freshen up some concepts before final approval from management. I just had two very fundamental questions on DHCP Relay agent.

1. DHCP relay has to be configured if DHCP server and DHCP clients are on a different subnet. But if there are more than routers on the path between DHCP clients and DHCP server, do we have to configure DHCP relay in every hop? Or do we configure DHCP relay in only the router on the same subnet as that particular DHCP client?
   Please refer to the this image, do we have to enable DHCP relay in router 2 and router 3 ? My understanding is, router 1, if configured with DHCP relay, will convert DHCP Discover and Request broadcast packets to unicast to DHCP server, so no need to enable next hop routers as the messages are already unicast. I just wanted to double check.
2. Which interface do we configure the DHCP relay in router ? The interface directed to the DHCP client (downlink interface / southbound interface ?) or the interface directed to DHCP server (upllink or the northbound interface)?
   Please refer to this image, I think it's the interface directed to the DHCP client. Again I just need to double check.
   

Like I said, just needed to double check before preparing the final design. Thank you everyone in advance.

Will RJ45 Pinout A standard communicate with B standard?

Let me clarify this question as I can't seem to track down the answer online. Will an A standard pinout that's been punched down to a patch panel, communicate properly with a B standard cable connected to it?

Very old cables going through the building are finally being redone on one end. B standard is building wide and these cables just so happen to be A standard that I guess was terminated this way long ago. I am unable to re terminate one end as it's unreachable currently which would solve this case immediately and make it the proper building standard. Which leads me to my next solution which would be to go through with the patching and just leave it A standard.

About Cisco Router PKI FQDN?

Hi Guys,

We do have a dmvpn with IPSEC profile which certificate is being used for authentication and Would like to ask about how FQDN is being built, used and being presented to other routers?

​

1. By default does Cisco IOS uses its hostname and ip domain name?
2. Once you have successfully completed the auth/enrollement process. Tho the fqdn that is configured below is being presented to other router for authentication.. If the peer router has configured "match identity host domain test.com " so it needs to match the test.com domain from certicate fqdn?

​

crypto pki trustpoint TESTPKI enrollment url http://x.x.x.x:80 fqdn rtrhostname.test.com <cut> 

1. How to show/check the fqdn being used for the router? Is this the correct command?

   spoke1#show crypto pki certificates Certificate <> Issuer: cn=xyz Subject: Name: rtrhostname.test.com hostname=rtrhostname.test.com cn=xyz

2. From below logs from peer router why the fqdn present is different from the assigned fqdn on the certification "TESTPKI"?

   ISAKMP:(2015):My ID configured as IPv4 Addr, but Addr not in Cert! ISAKMP:(2015):Using FQDN as My ID ISAKMP:(2015):SA is doing RSA signature authentication using id type ID_FQDN ISAKMP (2015): ID payload next-payload : 6 type : 2 FQDN name : spoke1 <------- Router hostname is presented by the router?Why?

Any good resources on how modern network cards work?

Hi, I'm looking for information about modern NIC's and how they work internally both on the hardware level and the driver level (software), and how one could optimize the software actually utilizing these hardware devices. Or if there are any modern networking resources for programmers. The resources i manage to find like the https://beej.us/ guide are way to high level. And when it comes to the hardware i have no idea where to look.

Experience with Aruba switches? And what to expect?

When I hired in where I worked, we had all Cisco. Soon after I hired in we started moving to Brocade (now Ruckus). I have just learned that after switching about half of our Ciscos to Brocades (including some of our core), we are going to change to Aruba switches, and finish swapping out all existing Cisco that haven't been changed over to Brocade yet. So I will have a mix of Brocade and Aruba at the end of the project. Specifically, the Aruba 2930m and 8320. We already have Aruba wireless, but I have never really had to use their support. I am curious what others have experienced with Aruba switches? Performance wise and durability wise? And maybe what their support is like?

Anyone using multi mode for 100G links within a data center?

As the title says... most people I know are either doing AOC for leaf <> spine connections at 100G, or just straight LR4 or CWDM single mode optics

I know you can do 100G over 12 strand OM4 multi mode fiber and it looks pretty cheap. Distance is pretty limited but that should be fine within a cage.

Curious if anyone is actually doing it thou

Python course/tutorial recommendation

As the title says I'm looking for a recommendation for getting into Python with the ultimate purpose of doings some network device automation. Here's a few details about my experience so far.

1 - I'm a fairly well rounded network engineer, just got my CCNP RS, also know my way around most of the devices from the major players in the industry as well as some rudimentary Linux stuff (mostly the networking side).

2 -. I did some programming in high school (~15 years ago), Pascal and some C++. The usual stuff you do in school, trivial math problems, sorting algorithms, some graph/tree stuff (bfs, dfs, that sort of thing) some backtracking. Back then I enjoyed it a lot. Definitely my favorite subject but I feel it's very little compared to what even a junior programmer would know.

3 - I never made something complicated. Probably the biggest thing I ever wrote was a "Minesweeper" implementation, probably <1000 lines of code. I never worked as part of a team, I have a feeling trying to figure out someone else code will be quite a challenge.

4 - I did a very tiny amount of OOP. My guess is that, when it comes to real world programming this will be a necessary requirement.

What trainings/books/tutorials would you recommend for this? Hopefully something that will do a fair bit of hand holding and that involves a lot of exercises.

This is probably next level and will come with experience, but I'm also I'm hoping for something that will emphasize some good coding habits. How to write code that's easy to read/understand and maintain. How do you write "robust code"? How do you write portable code? How to separate functionality into layers. What are some high level features that would be desirable (I'm thinking about stuff like idem-potency or ACID)?

What would you recommend I try?

Visio shapes/stencil for network protocols?

I'm looking for some shapes/pictures to use with a network diagram. Preferably that will work with Draw.io

Edit: specifically, I want logos for BGP, OSPF, UDP and TCP etc.

I know they are not companies, but have anyone seen a logo/stencil for them?

IT gadgets

Guys,

the coolest gadget that you got at the IT conference?

Cisco ACE SSL termination

Hello,

do i need to add something else to make class class-default work?

policy-map multi-match VLAN220_POLICY_L4 class SHAREPOINT2013_CLASS_L4 loadbalance vip inservice loadbalance policy SHAREPOINT2013_POLICY_L7 loadbalance vip icmp-reply active loadbalance vip advertise active nat dynamic 17 vlan 220 appl-parameter http advanced-options HTTP_PARAMETER_MAP ssl-proxy server STAR_SSL_PSERVICE_SERVER class-map match-all SHAREPOINT2013_CLASS_L4 3 match virtual-address 192.168.220.54 tcp eq https policy-map type loadbalance first-match SHAREPOINT2013_POLICY_L7 class FORMS_CLASS_L7 serverfarm SHAREPOINT2019 ssl-proxy client SSL_SHAREPOINT_CLIENT class class-default serverfarm SHAREPOINT2013 ssl-proxy client SSL_SHAREPOINT_CLIENT class-map type http loadbalance match-all FORMS_CLASS_L7 2 match http header Host header-value "sp.mycompany.com" 3 match http url /forms/form1 

When I type sp.mycompany.com/forms/form1 I see page from serverfarm SHAREPOINT2019 as expected to FORMS_CLASS_L7 from SHAREPOINT2013_POLICY_L7. But if I type sp.mycompany.com or sp.mycompany.com/otherURI I didn't see page from serverfarm SHAREPOINT2013 as according to class class-default from SHAREPOINT2013_POLICY_L7.

Mellanox compatibility - 100G LR transceiver in NICs?

Hey guys,

bit confused and cannot find the info I need, plus did not get much response from Mellanox until now. We're planning on getting a couple of systems with Mellanox ConnectX-5 dual port 100G adapters (CX516A-CCAT I guess). Because we want to avoid using MPO cabling we were going to settle for LR transceivers "in-datacenter". Not ideal but we've done it before without any issues. However our channel supplier said, the Mellanox LR 100G transceivers (MMA1L10-CR) are actually not compatible for the NICS, only for switches.

Anyone got any insight on this?

I know that LR transceivers in NICs directly are not the most common scenario, but with 10G/Intel that was not an issue ...

Thanks!

I have no idea what im doing...

I work as a program developer, and Im kinda the office potato atm. My colleague asked me if I could help him with a problem he had:

We are a small company, and our team leader needs to be able to fix things from home, but he needs to be on the same IP as the office because of a program we use.

Now I just really don't know where to start. Ive tried google, but I just don't get the answers I'm looking for. I was given a ZyXEL USG40 and told to setup a VPN, but there are so many options and I don't know what type of VPN to set up, there are many tutorials on how to set things up, but I dont know which one Im supposed to use.

Also, the ZyXEL is connected to a SonicWall SOHO, and this is again connected a router (I think) which is connected to the socket in the wall.

I can figure out how to do the separate things, I just dont know what those things are. Do I also have to setup forwarding pointing toward the UGS40 as well? Thanks so much for any guidance!

Combining Dell N3000 Switch Stacks

I have a client that has two Dell N3000 stacks. One stack consists of 3 N3048's and the other of two N3048P's. I'd like to combine, and possibly remove one of the N3048 switches so that there are two POE and two non-POE, or something along those lines. Couple questions:

1. I undestand I can hot-add the swtiches from one of the existing stacks to the other. Am I to assume that I should reset the switches I'm adding into the other stack so that they aren't fighting on who is master with two different configs? Or do I need to shutdown the stacks and connect them together properly?
2. If I can combine them hot, I'm assuming that I can't just combine configs...I'll need to prep a config on the switches I'm adding to the stack that looks similar to the existing config but with the port ID's changed to match the new stack member ID?
3. Anything else I'm forgetting? The switches should be pretty darn similar in config such as routing, STP, etc but I'll check that out for sure.

Thanks!

Data center Circuit - Out of order ingress packets - WAN and DCI

Hey guys,

​

So I posted earlier this week about an issue we were having in our DC --> https://www.reddit.com/r/networking/comments/f5k828/inbound_packet_lossooo_packetsdup_acks_to_dc_vm/

​

​

We started to capture on our ASR's interface connected to the DCI and saw the packets coming into the DC OOO. A capture on the other end confirmed it didn't happen before hitting the fiber.

​

The internet and DCI circuits are provided by the DC so they have something in common but have you guys ever experienced anything like this? The DCI is sold as dark fiber so you'd think it wouldn't traverse the same path as the internet circuit.

​

We are failing over to a Level 3 circuit tonight to help clear things up.

UK - Best connectivity options to Equinix LD6 in Slough from Central London based office?

Hi All,

It's been a while since I used a Data Centre myself and I am just wanting to double check if I am missing anything. This is basically an Intel gathering post.

The firm I now work for have a "currently empty" rack in Equinix LD6 which we need to connect back to our offices in central London and begin populating with network and kit. We currently have BT and Colt as well as G-Networks as network providers in our office, but we would be willing to bring more carriers into the building if their was a performance and or commercial reason to do so.

This rack will contain our backup servers and storage so that we have something to recover our office based devices from if we ever had a worst case DR event in the office. The initial data sync from our office location based PC and Server equipment will be roughly 200 PC's and about 30 servers with a total data size of around 13TB for the initial sync. The Daily Delta will probably be less than about 1 GB.

The network link would be dedicated to just this backup scenario and we don't intend to do many restores back to the existing office. Their might be the odd use case for restores, but if a major disaster like a flood, fire or plague of land sharks with ** Lasers ** mounted on their heads, was to befall our office, we would most likely be restoring our kit to a DR location (Still to be determined). For now just getting the data to survive an event is the primary concern and we will work on how we restore it later.

Can I get away with just bringing in an 100 Mb or 1 Gb internet link at both ends and running a VPN over it for the backups? I imagine the initial sync would be an absolute bitch in this scenario and could this handle the Delta on a daily basis? Backup window would be from 11 PM to 6 AM UK time so only 7 hours to play with.

We are not short on Dosh, but I imagine on the other end of the scale, Dark Fibre is overkill? What is it like getting Dark Fibre installed to a rack in LD6? Any complications we should be aware of?

Besides Colt and BT, are their any other good network providers available in LD6 that I would be better of dealing with? The time suck and admin of chasing BT and Colt around to just get them to install kit in our office was painful.

Blogpost Friday!

It's Read-only Friday! It is time to put your feet up, pour a nice dram and look through some of our member's new and shiny blog posts

Feel free to submit your blog post and as well a nice description to this thread.

Equallogic network alchemy ??

I haven't used EQL PS arrays in awhile but recently I encountered one. In case you aren't aware these arrays have multiple network interfaces (for ISCSI) but all of the NICs have to be in the same subnet. So right now all of the hosts and all of the array NICs are connected to the same switch. Which works fine and dandy even multipathd works fine.

I wanted to move one of the controller NICs (and its failover on the secondary controller) as well as the secondary ISCSI NICs on the hosts over to another switch for minimal redundancy...

So I connected the ports up and if I ping the secondary NIC on the PS controller it fails. I am assuming that either the Linuc ISCSI initiator is trying to send the ping requests out via the other NIC (same subnet, required remember) or the array is sending the response back on the wrong NIC.

I have these commands on my linux host to try and make Linux not care which NIC it sees the replies on. Which is probably why multipathd works with the single switch setup. I just cannot for the life of me remember how you make it work across two switches that are not interconnected. Also since the PS group uses a load balancing front-end IP I don't think routing would help.

sysctl commands

net.ipv4.conf.p2p1.arp_ignore=1 net.ipv4.conf.p2p1.arp_announce=2 net.ipv4.conf.p2p1.rp_filter=2 net.ipv4.conf.p2p2.arp_ignore=1 net.ipv4.conf.p2p2.arp_announce=2 net.ipv4.conf.p2p2.rp_filter=2

I used to know how to fix this but its been... a while. If anyone remembers please let me know. :)

Job Salary

Good evening all!

So I earned my CCENT in August of 2019 and my CCNA Routing and Switching back in January, and since I've put my resume out there a few days ago, I've already received an offer. Now I know I will most likely be low balled by employers, but since I have no IT work experience but I have these certs, what is most likely a good asking salary range for a network engineer? I don't want to get taken advantage of, but I also don't know what would be expected of me on a day to day basis so I didn't specify a salary when I was talking to the headhunter.

Thank you!

Will this network set up work?

I am going to participate in an event which involves getting internet to 12 PCs using one main Ethernet line with a static IP. We have one Wireless Router and a 24port unmanaged switch.

Will connecting the static IP to the wireless router, connecting the switch to the router, and connecting the PCs to the switch work? Is there any configuration required on the PC end?

Thank you.

Looking for an IPSEC VPN Host for Client VPNs

So my company is searching for a suitable IPSEC host for our Client VPN. Looking for any recommendations. Since this will be used as a disaster scenario application for an automation environment and not your typical everyday Client VPN security is of more importance than ease of use and/or scalability.

We are thinking about your typical Cisco ASA, a Sonicwall and Fortinet. But looking to see if anyone else has a better host. SSL/TLS isn't quite out of the picture yet, but for the purpose we using this for we think IPSEC is the way we will go.

Does anyone have any recommendations and/or feedbacks on specific services?

8 port FXO suggestion ? (crosspost from r/VOIP)

8 port FXO suggestion ?

Hey im not typically the voice guy, but this landed in my lap about 6 months ago... brief rundown below

• hotel we were doing the network for was supposed to have 8 POTS lines delivered for their PBX system
• POTS lines didn't get delivered because of construction problems

• I hopped on google, found an FXS, Grandstream GXW-4008, slapped it in, tied it into OnSIP, had dialtone, plugged into PBX, bobs your uncle.. right ?

  • Month later they had to reboot the gxw-4008 because of fast busy ? (hope its a one off...)
  • received a call a few months later, had them reboot... same... *cross fingers...* dont do that again.
  • got a call this morning same thing....

• POTS Lines still haven't been delivered 6 months later... Im told its right around the corner....

Id prefer to replace this unit with something rock solid that is compatible with OnSIP, i need 8 ports, and something that i dont have to ever think about rebooting.. suggestions ?

Looking for a split tunneling VPN for iPhones that uses certificates to authentication.

We would like to have only certain IP addresses run back to our DMZ. We would like to avoid passwords so it will be quick to kick off but still use individual certificates so we can revoke them as needed.

Is there such a thing or are we making up a product spec that is vaporware?

Cisco video course

Has anyone used the video courses offered by cisco? Are they any good? I just barely missed getting my CCNA today, was trying to get it before the new one gets released because I took a routing and switching class for my degree but now I'll have to study for the new exam and the study materials offered by cisco are on sale for the new exam. Are they worth it? Or is there a better study source out there?

BCP: Taking up fiber patch cable slack

Reddit Networking Hive Mind, I come to you with a query that has long vexed me: when putting in SMF/MMF patch cables, no matter what cable length you order, there is always slack.

In our datacenter, SMF crossconnects are everywhere, and taking up the slack is a huge problem, especially as the runs get longer -- there is a lot of slack if it is a 65' run and your choices are 20 and 25 meter cables.

What is the best current practice on dealing with this? I've seen loops in the vertical organizer. I've seen it bundled in the horizontal. I've seen it tightly coiled perpendicular to the rack in the horizontal. I've seen 1RU decks with spools, which explode into spaghetti when you try to get something out.

Any thoughts, links, pics, or similar would be greatly appreciated while we attempt to tackle cleaning up a beast. Thanks!

FTD 6.4.0.8, anyone using it?

I have three FP 2ks and some "classic" 3D 7000 series appliances, all running 6.4.0.6.

Suggested release is 6.4.0.7 but my 2ks are hitting a cosmetic bug that causes the nasty red ! to show up in FMC. The bug is supposed to be fixed in 6.4.0.8.

Would like to upgrade to 6.4.0.8 if it seems like an OK release but I'll live with the cosmetic bug for a while longer if I need to and just go to 6.4.0.7.

Testout vs CBT Nuggets vs Udemy vs Pluralsight

Ladies/Gentlemen:

I'm a noob here so please go easy on me. I am trying to differentiate the pro's and con's of choosing Testout vs CBT Nuggets vs Udemy vs Pluralsight (the paid membership version). What is the best one thus far for learning a Cisco or Microsoft Server cert? What has been best for the general public as far as these learning sites? Thank you in advance.

Random story of working at an ISP.

I work at a pretty big ISP as enterprise network support. Often I have to do a lot with IPv4, including just verifying whatever we have in the routing table for a customer.

I get a call from a huge ISP tech, asking to verify IPs because we have the modem there and assigned static IPs. But he has to put me on hold, to call another ISP who manges the router. Ok. So it'll be 3 techs on the phone, no biggie. Well ISP#3 has to call the MSP onsite to make IP changes...

The call is now as follows:

ISP 1 - modem/static ip (me)

ISP 2 - monitoring it all (originated this call)

ISP 3 -.owns the router

MSP - smarthands, works for ISP 3 onsite

So after all four of us are connected, we go over what I have allocated, and verify they used each usable IP as it's own CIDR address and so used IPs not meant for them. Right after the MSP starts putting in the correct IP addresses, ISP 2 goes, "ok sounds like you don't need me anymore, bye". I realised who was leaving the call a half second before, and then boom we all get disconnected.

No call back numbers, each of us lost in the giant machine we work for. Took like 20 minutes to get us all on. I was laughing for a solid 5 minutes.

Does a switch operating as a DHCP server need to be configured to a VLAN?

I am working on a project where we are removing a router that is currently acting as a DHCP server to a remote site for the company I am at. The router is ISP owned, so I am not privy to their configuration. We have juniper EX2200 switches at our remote sites, and though they have the capability of operating as dhcp servers, I cant seem to get them to actually assign an address to a host unless I assign the dhcp server to a vlan and put that port on that same vlan, which I am actively trying to avoid doing, as we are small enough that we currently have no vlans. The Juniper documentation online is no help, and I cant get a solid answer to this question. Is there a way to configure DHCP so that it will just hand IP addresses out switch-wide without getting vlans involved?

Opinions on Meraki switches

Hey /r/networking I'm in the market for a pair of switches for a new data center deployment. My preference is Cisco but the company I work for has a pretty decent discount on Meraki gear so the boss is pushing me to look at their switches. I'm eyeing the MS250 & MS350 and both seem like they'd fit the bill and do what I need.

My requirements aren't super complex: -Layer 2 only, no layer 3 at the moment -Not running any routing protocols -10G uplink -1G RJ45 switchports -Option for redundant power supplies preferred

We currently use Meraki for Wifi deployments but I haven't worked much with their firewalls or switches. Meraki seems to be a bit polarizing, network guys seem to either love it or hate it. My impression is that Meraki makes good gear but there isn't much in terms of granular configuration options and the licensing structure makes it so you never truly own your hardware.

Can anyone who has worked with Meraki switches weigh in and let me know your experience/opinion.

How to explain why end device should not go on core switch?

I am having trouble explaining this to my co-workers so they can understand. I been trying to redesign the network to organize everything into a collapse core on multiple sites and move end device from the core as a backbone. Devices are just plug into random places and no network topology is available.

Juniper switch advice

Juniper ex2200 24-4g switches.

I have just inherited these from an organisation we took over. I need to configure them fast. I have to get WAPs working on each and uplink them to some HPE/cisco switches. I have got them to factory default, changed the password and reading like mad on how to config but help on the following would be awesome.

So I need to give them a name, IP address in VLAN 1253 and set SNMP strings

I would like to create a bunch of layer 2 VLANs

I would like to create an uplink trunk port carrying all VLANs

I would like to create default route

I would like to create a standard interface config with,

a native VLAN (for WAP to boot in) and a number of tagged VLANs (for WAP clients)

POE on all interfaces

commit config

Any advice would be gratefully received.

SaaS-based Network Monitoring tools

Anyone use network monitoring tools that have on-prem collectors that report up to a cloud-based SaaS? Curious to hear what the experience has been like compared to on-prem solutions like Solarwinds, MRTG, etc... I don't know many players in the field except LogicMonitor, Auvik and wondering if anyone has used them and what they think.

pros and cons of using private subnet

I'm not sure if this is the right sub to ask this question because this is about AWS VPC, but anyway... I'm trying to improve an existing Elastic Beanstalk setup. There's a dozen instances behind a load balancer. Each instance has a public IP, although I've now closed it off such that only the load balancer can connect to them. Question: what are the benefits or disadvantages of leaving the instances inside a public subnet? I can move the instances to a private subnet, but they will no longer have Internet access. We'll have to pay for a NAT Gateway. I can't understand why it's more expensive to use private-facing instances. Maybe I'm missing something?

I am missing something obvious? IP-VPN routing issue with remote sites to internet via Head Office

So i have a customer who has several remotes sites set up in an IP-VPN (MPLS) that try get their internet through the Head Office.

All the devices in the head office can get to the internet and all the remote sites can reach the head office, but all the remotes site traffic stop at the Head Office and never go to the internet.

The head office does BGP peering with the Service Provider and the remote sites learn the routes back of the service providers with RIPv2, and all have learnt static's pointing to the Service Provider next hop.

The head office has a static that points to the Firewall/Internet but traffic doesn't seem to be getting picked up by the default route for the remote sites when it reaches the head office.

One thing i found peculiar is that the L3 Head Office switch has the Firewall/Internet as an OSPF neighbor but they seem to be on two different networks:

L3-CORE-SW#sh ip ospf ne

Neighbor ID Pri State Dead Time Address Interface

10.255.255.1261 FULL/DR 00:00:39 10.255.255.126 Vlan255

interface Vlan255

description *** Routed uplink to Firewall/Internet***

ip address 10.255.255.121 255.255.255.248

ip ospf authentication message-digest

ip ospf message-digest-key 1 md5 2b14d20c

ip ospf network broadcast

ip ospf cost 10

end

They are on a /29 network VLAN 255 in in range 10.255.255.16/29 while the Firewall is in 10.255.255.24/29 range but OSPF is UP.

The remotes sites however can't ping the Firewall but they can ping the L3 switch which has a direct connection to the Firewall and a static route pointing to the Firewall

Ref Image:

https://ibb.co/tY0jB8q

[Beginner question] If I am asked to find the number of web sessions that have been captured on a file (using wireshark), would I look for the count of total http packets?

Basically, would 188 be the answer to the question? or is it 94, the http request packet?

DMVPN with PKI auth and enrollment?

Hi,

When you first configure a trust point the next thing you will do is to manually enroll and authenticate the CA to itself with the standard procedures.

crypto pki authenticate <trustpoint> crypto pki enroll <trustpoint> 

Once the CA has successfully authenticated and enrolled the certificate then will be stored on the routers local storage.

Question:

1. If router reloads, basically it will use the certificate installed on local storage and router doesn't do automatic authenticate and enrollment on it reboot?
2. So this mean that if the certificate is still valid for a period of time then we don't need to repeat the manual auth/enroll process?
3. During the troubleshooting would you recommend re-authenticating or re-enrolling to trustpoint? If yes, what would be it's advantage. If no, what would be the risk repeating the process?
4. In what instance should we repeat the manual auth/enroll process?

​

Thank you

Printing In Co-Working , Does Papercut or the infrastructure suck ?

Good Evening all,

I have taken on a co-working space with a pretty crappy print management infrastructure. There are 3 locations , 2 locations with vpn tunnels to the 3rd location which has on-site server running the printing application. Users are required to run a script on their device and register their devices in order to print. This application is Papercut.

My proposed solution has been to run a separate server at each location hosting the printing application however I am worried the overall application itself, Papercut, is not the best solution here.

Some issues we have, printers losing connectivity to the server even though they are statically assigned, Windows devices operations fine while MacOS devices not (and vice-versa). Inability to log into Papercut instance even though the server and printer can be reached locally.

Would love to hear your thoughts !

Any ideas on this?

/r/Cisco/comments/f6lull/hsrp_router_wont_respond_to_arp_with_acl_on/

Has anyone taken Dell Test DEA-5TT1

I need to pass this for my company. I just viewed the On Demand course that goes with it. It seems like a watered down CCNA type test. Reading the blue print, nothing sounds very difficult. Although it looks like 10% is product specific, and their model numbers dont really seem to have a logical sequence to them.

​

But wanted to see if anyone has taken this test, and can give me any pointers. For Route Switch I'm already a CCNP. I'm just concerned if the test is almost trivia question; like what year did IEEE ratify IPV4.

cisco anyconnect through FTD with microsoft NPS

Anyone utilizing this and know how to make this work without enabling PSP SPAP, or is that the only thing you can do. I would much rather use PEAP, but for some reason I cant get it to work without enabling unencrypted PAP/SPAP.

Good reads/good documents/good vidoes, or just plain this is what to do is appreciated.

SCP Copy to Nexus

while copying a bin file from an scp server to a device, I noticed that when ran the Dir command

1688180224 Feb 19 12:11:03 2020 \NexusUpgrade\nxos.9.3.3.bin - was the only file I saw. I will be updating a 9k, and not sure I could use that when doing the boot command.

I re-uploaded the file using a single line:

copy scp://cisco2@10.10.10.10//NexusUpgrade/nxos.9.3.3.bin bootflash:

That command placed the bin file in the directory the way I am used to seeing. just nxos.9.3.3.bin without the path name.

Now I cannot delete the top line. what did I do wrong and how can I remove that top line?

Hostname# dir

1688180224 Feb 19 12:11:03 2020 \NexusUpgrade\nxos.9.3.3.bin - 1st attempt at copy

1594 Dec 14 15:09:28 2016 bios_daemon.dbg

4096 Aug 16 14:58:05 2016 home/

339 Aug 16 15:00:34 2016 license_FDO20291NMA_3.lic

4096 Jun 27 18:02:45 2018 lost+found/

1413271552 Aug 28 08:52:44 2019 nxos.9.3.1.bin

1688180224 Feb 19 16:31:23 2020 nxos.9.3.3.bin - 2nd attempt at copy

Can motherboards have an effect on disconnections?

I've had this asrock z270 taichi for a year now and since day one I've had connection issues. Not slow connection, but sometimes my computer randomly disconnects from the internet and I have to wait like 5 min until it automatically comes back. I really don't think it's my router/modem because they're both new and with up to date firmware, and because this doesn't happen on my other devices (phone, laptop, tablet). My dad says he never disconnects either, so I've deduced it down to the motherboard. It has onboard wifi, but I use an ethernet connection. I just need an explanation because I'm getting tired of this.

Hair-pinning Network

I've got a complicated question... I am creating a BYOD network on our higher ed campus. I've got non-AD joined/university-owned devices set up to go to a stricter network using google DNS and cutting it off from resources it doesn't need. Aka a student's cell phone. I take it from a 10.x.x.x and NAT it out to our public IP space in the PA firewalls. From there I'd like the traffic to be seen as outside/internet traffic if resources are needed from servers on our campus coming back in. Currently, we have rules between zones allowing it to cut over to a server and the connection is seen as an inside zone. Is there a way with routing to easily hairpin that traffic back or does anyone do something similar?

We have a PA firewall and outsider router beyond that could be used. Trying to figure out how to route/hairpin it to get things working as they should. Basically take natted connections that go out and hairpin them back in as if though they were a random Joe on the internet. We have rules in place allowing access from the internet now so that parts there and working.

Example:

Want:

Untrust/Internet Zone to Campus Web Server

Currently Have:

BYOD Zone to Campus Web Server

Open to any questions/clarifications/criticism on the idea.

VLANS resource modules for Ansible Network Automation

As to follow rule #3 for r/networking I won't just link to an external site without any content for Reddit

For Ansible a "resource module" is a module that specifically configures a single resource (think config section in Cisco speak) such as L3 interface information with os_l3_interfaces (IPv4, IPv6, etc), or os_vlans module that configure VLANs (name, vlan-id, state). The goal of resource modules is to make Ansible easier and more modular (excuse my pun :) . Historically Ansible was super easy for novices to get started...... but then Ansible Network Automation could get really complicated unless you really understood Jinja2 templating with the config modules. This made network automation difficult to adopt for many network engineers that didn't want to spend time troubleshooting a 1000 line Jinja2 template with a hundred if statements for every scenario.

Lets look an an example:

--- - name: add vlans hosts: arista gather_facts: false tasks: - name: add VLAN configuration eos_vlans: config: - name: desktops vlan_id: 20 - name: servers vlan_id: 30 - name: printers vlan_id: 40 - name: DMZ vlan_id: 50 

As you can see in the example, each resource module has a very simple associated data-model. Instead of creating a super complex all-encompassing data model (think of my Jinja2 comment above) we can create a per-resource data model. This allows you to not approach automation as a "all or nothing" but adopt it on a per-resource basis.

What this means is that you can get some quick ROI for learning Ansible. You don't have to necessarily automate an entire configuration for your Cisco IOS router or Juniper Junos switch before you get some benefit for spending time automating. You can automate just standardizing your VLANs and enforcing configuration policy and then keep adding resource modules as you adopt network automation across your infrastructure.

There are three state parameters for resource modules that are standard across all new resource modules (e.g. ios_l2_interfaces, ios_l3_interfaces, ios_interfaces, etc). They are merged, replaced and overridden.

Merge just makes sure that the configuration you are providing will exist on the network device. It just merges the configuration into whatever is already configured on the switch.

replaced will remove what you don't configure for a given resource. Each resource module is fully aware of the data model it provides. For example, if the vlan configured on an Arista EOS switch looked like this->

vlan 200 state suspend ! 

But you sent this->

- name: desktops vlan_id: 200 

It is going to remove state suspend because you didn't send it. In other words it knows what "shouldn't" be there.

Overridden takes this concept a step further and is aware of all resources holistically, for the vlans example this means all vlans. So if you don't have vlan 100 in your data model, it will remove vlan 100 entirely and enforce configuration state.

I hope this helps illustrate the concept of resource modules, I know this concept is new to a lot of folks and I am working on content to help make this super easy! I will try to make my next blog post about return parameters for each of these resource modules and how to use them in your Ansible Playbooks, and how to read in brownfield networks and turn them into data models (structured data!). Hopefully I have not bored you to death at this point!

Link to blog post with more information

Looking for Cisco IPSEC Checklist

Got any ideas that would help this caveman, please share, I'm having trouble establishing IPSEC settings that work between an ISR and FTD. Switching between CLI and FDM is confusing and each device uses different names for elements in their IPSEC framework.

My friend says I'm over thinking the problem. First time I've been accused of that.

Busy 2G wifi, unsure how to proceed

We're having 2G WiFi issues at one of our clients. People working in 'Room A' (Floorplan), complain about being unable to get a connection. And when they have a connection, it's slow.

All APs are UNIFI mesh type.

I did a scan:
AP1 Channel 11
AP2 Channel 11
AP3 Channel 1
AP4 Channel 6
AP5 Channel 6
Floorplan. The walls mostly are just plasterboard/drywall (also between AP1 and Room A).

The current channels were picked about 6 months ago, based on a scan done back then. Unfortunately I didn't make copies of those scans.

Ap2, AP3 & AP4 cover 10 rooms and are fine, no issues there. AP5 is busy according to the scan, but it's the library and usually only one or two people at a given working there.

I'm not sure how to proceed here. Change the channel of AP1 to '13'? Move AP1? Add yet another AP in Room A?

WLC Anchor Design for Multiple Branches

Hello Guys,

​

I have a customer who has the following design:

1- One WLC in the Head Office

2- APs are configured as flexConnect and joining the WLC in Head Office

The new Requirement is Guest WLAN in all branches. I know you can have an Anchor WLC in the DMZ and the guests will be tunneled directly to the Anchor WLC in the DMZ which will isolate them from the LAN and they can surf the internet.

The problem is that if we place the Anchor WLC in the DMZ of the head office then all the guests from all branches will use the Head Office internet since the Anchor WLC is physically there. However, the requirement is that all the guests must use the branches' internet gateway.

​

Should we place Anchor WLCs in all the branches to fulfill the requirement or there is a workaround?

​

thanks in advance

SIP Monitoring/Capturing System (VoIP)

I'm currently a Network Engineer in a ISP, and have been given the task to implement a VoIP SIP packets capturing and monitoring system. I've installed HOMER and decided to go with port mirroring on a switch port where these VoIP packets traverse to our clients.

My main question here is: What do you guys think is the best solution for this? HOMER seems pretty legit although a bit resource intensive. Which is the best Capture Agent? I can see there are many options out there: CaptAgent, Kamailio, HEPify, etc...

Scalability and availability-wise I do see an advantage in capturing/monitoring these files to the cloud, although this does imply high costs depending on the size of these logs.

Arista LLDP TLVs

Anyone know if it possible to get Arista switches to advertise list of VLANs on a trunk in LLDP?

I have checked a few of our switches running eos and it looks like they only support a limited range of TLVs - VLAN information seems to be limited to the PVID/native vlan only.

I think I need to get this TLV - "VLAN name (Type = 127, Oui = 0x0080c2 (802.1), Subtype = 3)"

(config)#lldp tlv-select ? link-aggregation Link Aggregation TLV management-address Management Address TLV max-frame-size Maximum Frame Size TLV port-description Port Description TLV port-vlan Port VLAN ID TLV system-capabilities System Capabilities TLV system-description System Description TLV system-name System Name TLV 

0.25m SFP+ Direct Attach Cable (DAC)

I am planning to connect two switches via SFP+ the switches are separated by a patch panel. However I can only find 0.5m in length for DAC. Any suggestion where i can find a DAC that is 0.25m long?

Beginner’s guide to local networking?

Currently trying to troubleshoot some things on the local network. All these Linux command line tools have kind of thrown me in the deep end. I’ve encountered ARP, DHCP, DNS, ports which are different from local IPs, Mac addresses, interfaces/devices that are for some reason different on different computers, packets, bridging, SSL, ICMP, NDP. TCP. The list goes on.

I need to take a step back—but where do I start? Are there any good books/resources where I can start from the beginning and learn about all of these things? I don’t need in-depth understanding—I think that will come with further research and playing around—but I do want to understand what I am playing with.

Edit: one question I would like to have answered by you guys: if I run this command on computer X

arping -I eth0 <computer A> 

And computer B is connected via Ethernet to computer X on computer X’s device eth0. When I run the command, it says

ARPING <computer A> from <computer B> eth0 

But nothing is actually being produced. Does that mean that computer B can’t access computer A, or computer X can’t access computer B? What exactly is happening here?

​

bgp multihomed rfc compliance

hi is it mandatory by rfc to have to different transit carriers if i want to be an as? or can i be an as with just one transit? thank you

Filter my home network traffic.

I have a few google home devices and other always internet-connected devices like smart tv's tabs etc. I just need to filter all traffic going through my internet router. Because in the last few months there was a huge traffic spike on my network (Per day upload 14GB download 60~70GB I am not listen to music from google home, just controlling lights), of course sometimes it's getting slow.

What is the best way to filter/view the home traffic? I need who access which website, What are the incoming request and outgoing request, and I need to group all those requests etc.

I know there's a tool called Wireshark. (simple google search found that. Then I installed it, but I don't know how to filter all traffic going through my router instead of the pc I installed Wireshark.) But is there any way to achieve it by installing proxy or something and divert all traffic through that proxy. I have extra PCs and a few Rasberry Pi's.

Faster Internet bandwidth between common ISPs?

Let's say I have an office in Dallas, and an office in Los Angeles. Both of these offices have AT&T dedicated fiber. Would I be guaranteed higher bandwidth between these two locations than say, using Spectrum for one office instead?

I'm imagining that I'd be able to take advantage of some kind of AT&T backhaul between the two, but I don't know that for a fact. Is it all just the general internet once you leave a local ISP? I've tried looking for documentation on this kind of thing, but I feel I'm a bit out of my element.

Weird ping spikes I can't explain or fix

So i ve been having this problem in every game i ve played for over 8 months now. I haven t done anything to my pc it just sort of started happening, and i first noticed it in overwatch but it s present in every multiplayer game. My ping spikes up and down more than my fps, i have literally just finished playing a game of cs. When i fisrt entered the game i was on 45 ping which is not great but normal i would say for where i live, but then it just started rising and it was allover from 58 to 75 and there s just nothing i can do about it. I know people who legit live 5 blocks down the street and have 35 ping and the same isp and i have almost double that . It just goes up and down without any logical pattern. I have :

-reinstalled windows

-updated drivers

-restarted router

-reset router

-contacted isp and they said they dont see anything on they re side

-contacted support of blizzard, walked me into weird windows procedures and none of them worked out

I suspect it being the router but i can t really change it since it servers a modem/router for my fiber subscription and if i would want to do it i would have to from the modem/router to the new router to the pc instead of from the modem/router to the pc.

How to build a multilink circuit

I have 2 T1 circuits and have to build a multilink for them. Can somebody help me with that?

On-Prem fiber. MMF vs SMF

I was talking to an AT&T installer that was doing some fiber work for me today. And we extended his equipment on the internal LC MMF fiber panels that were already installed in the building. They are large 1/2" Light blue fiber cables. Everything worked as expected and it all came up.

He brought up that there is SMF or MMF for internal on-prem building installs. And you really shouldn't do SMF on MMF.. I've never seen a 850/1310/1510 destination on actual fiber.

I've always believed that MMF can handle SMF connections and it's on on the SFP's which one you are doing. Granted you can't run MMF on the older SMF fiber runs.

Is he right, or am I?

​

Edited: for clarity..

my local host showing in tracert

I have a customer with concerns over her computers name showing up near the last couple of hops in a tracert to an IP in Vietnam. I repeated this and noticed the same thing, the source machine is listed with the remote IP.

Anyone care to explain this, first time I'm seeing it.

Also, the last time I ran a tracert on a modem with no router, the cable co. 10. IP and the public IP gateway were the first few hops - now they're not there and the first hop is nothing close to the public IP.

Newbies question: how do I make my own sever and make it can be ssh over Internet?

I don't know what do I have learn so Just throw some related topics at me or suggestions I am very familiar with linux.

Network+, CCENT, CCNA and CCNP. What kind of expectations do you have of employees (new ones coming in to your company) in each of these certified categories? How much, if any, leeway do you afford them?

As a blunt person, let me start off by saying it has been discouraging to read this subreddit sometimes as there seems to be a sense of elitism within the industry.

I'm referencing some troubleshooting posts that I see sometimes on here where, while some posters are helpful in guidance or even going so far as to provide answers, others are literally telling the OP's to tell their management to hire somebody else because they judge the OP's post and come to the conclusion that they should never be allowed to lay their hands on an Ethernet cable, let alone a network (I exaggerate, but you get what I mean).

That isn't to say that this sub SHOULD be a troubleshooting sub and it is true that sometimes people who post may be in over their heads, but for the sake of goodness sake, wouldn't they be better served with even miniscule guidance rather than the equivalent of 'lol noob' replies?

So back to my original question, what kind of expectations do you guys have for prospective employees just entering the networking world with their degrees or certs?

Understanding SIP and how SBCs work

Hi Reddit. Got a question that may be obvious. A week ago we were contacted by our security team that they were noticing the possibility of an intrusion into our ftth environment. For a little history of our network we deploy Adtran 352 ONTs to all of our residents. If the customer wants/needs a land line we provide it via SIP fed directly off the ONT. We provide a public IP address to the SIP controller in the ONT handed out by our normal DHCP servers so the ONT can reach our SBCs. All sip traffic is on its own VLAN separate from DATA.

The intrusion detected was 10s of 1000s of telnet attempts to the SIP IP of the ONTs from IPs in China, Korea, etc. While to our knowledge no one has actually gotten into our ONTs we know it's only a matter of time. (One of the shocking things we have discovered in this process is that the ONTs store the SIP passwords in plain text.) We immediately reached out to Adtran to determine how we could disable Telnet on the ONTs globally. We were informed by TAC that this was not possible and that we need to create an ACL on our network to block this unwanted traffic. After some heated discussion we are finally moving forward with this.

this now brings us to the point of this post. I need to verify that by blocking external traffic from upstream peers into the SIP network/ IP range that we should be able to prevent any form of a security breach. My biggest concern is I'm not completely sure how SIP works with a Session Boarder Controller in place. Does my SIP line need to be able connect directly to the IP on the far side, or is it communicating to the SBC and then doesn't need external access? Our belief and hope is that when a session is built that the remote device is communicating to the SBC and this is forwarded onto our SIP line. As a result we are only needing to be able to communicate directly between the ONT and the SBC not external IPs.

I hope all of this makes since.

Looking for help with Port forwarding

Suddenly the last few days I'm getting tons of lag spikes in games like Rainbow Six siege and Modern warfare on pc.

I don't have any antivirus other than Windows firewall and defender on.

I've had almost no issues with lag until recently and nothing with my setups has changed.

Ports for each game are forwarded according to trouble shooting sites.

Am I smarter to just delete all of the port forwarding settings in my router and start fresh?

I'm so frustrated as my internet speed tests out fine and when watching movies via Netflix at 4K no issues.

Just games on PC.

I'm out of ideas.

I'm hardwired into my modem as well and all my windows updates are done.

Called my internet company and no issues can be seen on their end so something is up.

OH and what happens is I'll get into games no issues at all but when moving I'll stutter backwards and my ping will go from around 28-40 to well into the hundreds and then back.

Rinse and repeat every few seconds.

I have 1 gig download speed and about 50 upload so it's not my speed.

Play streaming video traffic from wireshark pcap.

Hey experts,

I have a capture of a streaming service that I would like to play in a video format. We are talking RTP and H264 formatted video from a camera but every doc I have found online hasn't been able to help me in this regard.

Any of you have experience taking a pcap of a streaming video and seeing this visually?

Thanks

Rant Wednesday!

It's Wednesday! Time to get that crap that's been bugging you off your chest! In the interests of spicing things up a bit around here, we're going to try out a Rant Wednesday thread for you all to vent your frustrations. Feel free to vent about vendors, co-workers, price of scotch or anything else network related.

There is no guiding question to help stir up some rage-feels, feel free to fire at will, ranting about anything and everything that's been pissing you off or getting on your nerves!

Small Office Network Question

I hope this is the right place to ask this. My small office was rewired about 6 years ago with Cat5e to all the workstations. We are about to upgrade our internet package to Gig speeds (1,000mbps). I have already purchased a modem and router to support these speeds, and I know Cat5e supports them as well. Our network switch also supports these speeds. All of the hardware is a Netgear product.

Question(s) 1: will we see true Gig speeds at each work station? Or at least close to them? Is it worth the cost to have the office rewired with better Cat cables (6, 7 or 8) — its an office with 15 workstations and we do have VoIP.

Question(s) 2: If the Cat5e is hardwired to the stations (at the outlets) does using a better Cat cable (6, 7 or 8) from the outlet to the workstation improve speed, bandwidth, noise reduction, etc.? or is the connection limited to the Cat5e capabilities since that is what the outlet to the network switch is wired with?

Thank you for any and all info on this!

PBX on AWS Private or Public Subnet

Hello,

I had a few questions regarding the setup for a PBX setup on AWS or any cloud provider for that matter. Currently we have a CUCM environment which needs out phones locally connected to an on prem call manager.

We were looking at a new PBX solution hosted on a cloud provider but are struggling with some understanding of the fundamentals of setup. Should our instance be hosted on a private subnet behind nat (does it need any local resources) or should I just flat out put it on a public network with no NAT (do phones work through NAT?)?

I'm probably making this more complicated than it should be but obviously a public facing pbx would be easiest I just want to get the temperature of some more informed souls.

Thanks!

Multiple 1gb or single 10gb for VMware Host?

I plan on replacing our ESXi hosts which currently have 3 NICs dedicated for our traffic that serves our users. This traffic includes file/print sharing, AD, DNS, and some other apps. These 3 NICs load balance between each other. My question is would I be better off with one 10gb connection? Downstream from the ESXi host we have a 10gb core which then goes out to our other switches over 1gb links and finally to the client at 1gb.

​

The setup above is hypothetical. We do actually have 3 hosts for redundancy and I'd be using at least two 10gb connection for redundancy as well. I just wanted to keep the setup as basic as possible for the discussion. Also, if 10gb is the way to go, does anyone have any recommendations for a top of rack switch? I would like something relatively inexpensive with 24 10gb ports. I'd buy two for redundancy.

Cisco mmf to smf help

Alright, I've got a headache over something that should be so simple, but is getting complicated by others.

I'm a network infrastructure technician. I've just completed a fibre link to two job trailers(1x12f sm to each trailer). Single mode fibre was used. The smf runs from the trailers to a junction that has existing multi mode fibre that links back to the head end.

Now, my first thought was a mm-sm media converter in the middle, but the Cisco switches at each end don't seem to like this. I get activity on the media converter, but not the switches. So we stuck another Cisco switch in the JB and have the connection working, but this is only a temp solution(that's a really expensive media converter, admins don't like cascading switches). I've got a couple more media converters for fibre to Ethernet standing by to place on each end, but I'd like to hear if there are any other options. Diagram below.

Head end-mm fibre-junction-sm fibre-trailers.

TLOC Color Selection (Viptela)

Im a bit confused on what TLOC color we should be using for certain connections. I know the color selection will hint to the remote device wether or not it should use its NATD public IP for data plane connection but in my current environment we have a mix of DIA only sites and MPLS only sites. So for example:

Site A has 1 MPLS circuit and Site B has a DIA circuit. In order for site A to talk to site B , it needs to traverse a NAT/PAT device in my Data Center. According to Cisco, if a device sites behind a NAT device , give it a public color so that it uses my nat public ip to form ipsec. Cool but if i did that , how would site A talk to another MPLS site? Theres no nat inbetween them .

Going through the documentation i cant find any info on this scenario.

Fiber extender issues

I am having an issue with a fiber extender FS.com's 35334 using an 1mbps sfp with LC connectors OM3 fiber with lc-lc connectors CEX-LCLCOM3DGYPE. (Gray Jacket).

we are transmitting high bandwidth (700mbps) long frame (9000 mtu) video.

When the LC connector is pushed all the way in, we have video frame drops, but when the LC connector is pulled ever so slightly (before it goes click) the video is perfectly fine.

Here's a video showing the issue

Is this some kind of incompatibility between LC connectors? Is there such a thing? Any tricks of the trade to fix it

Only 1 in 4 PC in the same subnet can ping my DC/DNS Server in Packet Tracer? (file in post)

Hi everyone,

first of all i'm using packet tracer 7.3 so maybe that could be the problem. i'm a student and i'm still learning so maybe i forgot something but i can't figure it out.

So i have 3 subnet linked with 2 routers connected in serial DCE. Each subnet has its own switch and i think it's all configured as it should. Computers get IP addresses via DHCP that i first configured on each router. Both servers on the left are static 172.17.0.5 and 172.17.0.6 respectively.

Here's the plan of my project.

My problem is that in the 172.17.64.0 network, only the PC1 (DHCP ip) can ping my DC/DNS (172.17.0.6) in the 172.17.0.0 network. Weird thing is that they all can ping both routers, so they can ping externally. I really dont get how only one computer can make it but not the other ones.

Sometimes two or three PCs can ping the server, but i have to restart the app. Like wtf?

Static routes are well configured i think. So maybe someone could help me with that problem.

Here's the pkt file so you can open it

Thanks in advance

Cisco Switch Ports resetting themselves after disconnect and reconnect of Layer 3 uplink

Prefacing this with, "I don't network, so talk to my like I'm five."

In our camera system on multiple floors in one building (4 total switches), we needed to move the layer 3 routing config from one switch (Cisco C3560G - SWITCH A) to another completely new switch, in a different room (Cisco 2960X - SWITCH B). Re routed the cables so there was an uplink to our corporate network, as well as to the ORIGINAL layer 3 switch, which has had the IP routing config removed from it now. It's only uplinks are to the new layer 3 switch and to the other floor camera switches.

On SWITCH B, if we unplug the uplink to SWITCH A, all cameras we expect to drop connection do, and the ones we expect to stay up stay up. When we plug the connection back in, all of the switch ports reset themselves immediately, knocking all cameras offline, and then reestablish connection in 15-30 seconds or so.

Whats going on?

In a VLAN environment, how does a DHCP client know which VLAN to choose to send a DISCOVER packet?

Hi all,

We have a VLAN environment, where nodes (actually base stations in telco) are connected to switches/routers tagged with a certain VLANs. We need to configure these nodes as DHCP clients and install a global DHCP server for many such subnets. We will create separate scopes for each subnet in DHCP server config file.

Question is,

1. When the DHCP client boots up, how will it know which VLAN to pick up to send it's DHCP Discover packets? I mean, let's say according to network topology, this client's packets need to be tagged with VLAN 10. As we are using DHCP, so immediately after boot-up how will it know to use VLAN 10 to send it's Discover packets?
2. And in the DHCP Offer or DHCP ACK packet, does the DHCP server include any VLAN information for the client to use for subsequent packet transfer?

I think I read somewhere (can't remember the source) that it will first send untagged packet and then keep sending tagged packets with every VLAN by incrementing VLAN ID. Is it a general procedure or is this followed in client equipment by certain vendors?

Thanks in advance. Cheers !!

Customer's network lock out our data loggers for >4 hrs if they are disconnected then reconnected.

We design, make and install TCP/IP PoE data loggers. We have a customers where everything is working fine. However, if I disconnect a data logger and reconnect it can take up to 4 hours for our system to see it again. Works fine at every other customer and here at base, back in the room in 5 seconds. It's not a PoE issue as it's lit up like a Christmas tree, but it's not pingable and we cannot connect to it. Luckily our system recovers the data, but I need to get to the bottom of it. I'm due to visit them soon and was looking for pointers. Any help/pointers would be appreciated.

NEW TO DNS (HELP!)

We have a DNS Server in our company.
Primary IP: 172.16.10.3

Secondary IP: 172.16.11.3

However, if I access the company website thru internal network. It does not work if I put both the DNS IP in the IP settings. But when i changed it to 8.8.8.8 it works fine.
What is the problem of it? Do I need to permanently used the 8.8.8.8 configured on my pc DNS settings?
Thank you

SD-WAN Failures?

I have been reading and hearing a lot of SD-WAN success stories, all the money and labor a vendor’s solution has saved Company X. I want to hear about a time when the solution came up short... the vendor over sold functionality during a POC, poorly documented limitation or lack in functionality broke the architecture, a feature being enabled in production not going as tested, application running on MPLS that never survived the move to broadband based SD-WAN, code infested with defects (aka bugs), etc.

Please share your tales of failure, keeping it technical and not a vendor bashing session. My hope is that others can learn the lessons earned through your frustrations without having to repeat the experience.

Need advice on redesigning the network that I inherited

I have 8 sites and each site has a connection to a trunk layer 2 virtual circuits. So I have 28 tagged virtual circuits to maintain.

Is it ideal to have this mesh backbone? As far as I can tell, the mesh doesn't help at all since each link is just a vlan we terminate on both ends. The argument before was it provides redundancy.

In my opinion, that was false claim. The underlying network (providers) has redundant links. Our backbone network is just an overlay, so the mesh just added complexity. We have a single physical connection to the provider (trunk link), when there was a fiber cut on the provider side, the mesh didn't help at all.

​

Should I just make this backbone a /28 and maintain one subnet instead of 28?

​

Also, it seems like our enterprise is morphing into multi-tenant environment. Each tenant must be segregated from each other. However, the tenants must have access to our compute nodes. One of the tenant must have access to Internet2 only and another tenant must have access to our compute nodes and the Internet. Currently, the network is on the master/global table.

The tenants will come-in in a few weeks. My plan is to use end-to-end vrf-lite for each tenant and create a tenant vlan in the backbone. I will provide a /31 public address between me and a tenant. My backbone master/global table is using is-is for internal routes and ibgp for public routes.

Do I need to spin up another is-is for each tenant backbone vlan?

Is there a way easier way of doing this that is easy to learn in a pinch situation?

Decentralized operating system on a network

I am pretty new to operating systems and networking so a lot of this may feel impossible or maybe something like this already exists.

I was thinking if it was possible to make an operating system decentralized over a network. What i mean is that a network act as a operating system which could pool all the resources of the connected machines and a user could login from any machine and access his files or run a heavy process on multiple machines. I mean sure there are limitations of the Ethernet cables, routers, etc but still some heavy processes could be distributed easily and could help to pool resources of all devices. This would be great in offices, colleges, etc where there are many machines but of low configuration.

I don't know if something like this already exists if it does than please let me know.

Block 3000 IPs on Juniper SRX

Hello Guys,

​

I'm willing to block 3000 IPs on an SRX but I'm struggling with the best efficient way to do it.

I trick is block the address-set (address-group) in a policy but I need to define all the 3000 IPs in the address-group.

I'm planning to place all the IPs in a column of excel sheet and then just copy the command with incrementation

set security zones security-zone untrust address-book address Banned-IP-1 88.88.88.88/32

set security zones security-zone untrust address-book address Banned-IP-2 77.77.77.77/32

​

set security zones security-zone untrust address-book address-set Banned-Group address Banned-IP-1

set security zones security-zone untrust address-book address-set Banned-Group address Banned-IP-2

Does anybody have a better way?

DD-WRT or OpenWRT for a LINKSYS WRT3200ACM ?

Hi, what's the easiest to set up a Openvpn client on? It's a LINKSYS WRT3200ACM, and I can choose either DD-WRT or OpenWRT.

Starting with Network administrator for me to have experience then pursue network engineer, is this good path?

No text found

Hello guys, a question regarding a book

Hi. I was always trying to get hooked around networking, and now I have the time to do it. I am a total beginner, but I could get the book named "Network Warrior" by Gary Donahue, which was recommended by my friends for beginners. Is there anyone who could say a thing or two about it or recommend any position like this book? Is it good for total beginners or is it for people who are into networking for a longer while? Are there any better titles for beginners to read?

Inbound packet loss/OOO packets/dup acks to DC VM environment

Hello r/networking!

​

*Edit - We've checked all the switching MTUs and have no mismatches.*

We've been trying to track down an issue in our data center involving inbound TCP issues for about a week now with no clear answer on what could be the cause...and of course we're the guys defending the network. I know there's plenty of guys on here smarter than me so hopefully someone can help point our team in the correct direction or share some experience.

​

The infrastructure - It's your typical legacy design

ASR 1001x's at the edge doing default route to the ISP

Palo Alto VM300 - firewall

ASR 1002 - DCI Router to DR DC

Meraki MX 450's - Single arm VPN concentrator

Nexus 3548's - as service edge switches - VPC between them

Nexus 3132q's - as core switches - VPC between them

6300 Series FIs - Connects UCS environment to the network

​

Route's learned via OSPF - HSRP on the VLANs - SE and Cores connected @ L2 via port channels and then L3 links between the cores and se switches. Very simple and not much outside of that supporting the VM's in the DC.

​

Items of Interest -

1. No networking config changes have been made within 30 days.
2. BFD between the SE and Cores caused an outage about 3 months ago. "no bfd" on the interfaces connecting the SE and Cores brought the DC back up. Cisco's RCA was "don't use BFD internally"
3. The firewall is virtual (Palo Alto)
4. No traffic shaping in place anywhere inside the DC
5. I tested a backup job to an appliance connected via the core switches and receive the expected speed
6. A large majority of the VM's have been updated to 2019 recently - I've tried to disable ECN with no change in behavior.
7. VM to VM traffic is very very quick
8. Moving a file to another cluster on a different FI produces good results inside of the DC in question.
9. File downloads from the internet on a test server works fine

​

​

The problem -

Recently one of our sys admins noticed a .iso file transfer from our office via the Meraki VPN moving very slowly inbound into the DC in question. I saw it transferring @ 355 KB/s so I began to check for congestion on our inet circuit. Looking at our netflow monitor it was only @ 13% utilization at that particular point in time so that prompted a deeper look into things. (1G net connection)

I had him test the same transfer into another DC which moved at the correct speed into that location. Now I'm really starting to dig into what else could be going on to cause congestion. I pull up solar winds and no high CPU, no high utilization interfaces on anything... very odd. We then think "Perhaps its the net circuit so lets move the file via the DCI!" The 1G DCI really isn't used for much during the day and the path it takes into the DC bypasses all the usual suspects - The firewall, the meraki, the internet.

The DCI traffic produced the same exact results, same speed, all while outbound traffic moved at expected speeds. Now I'm looking @ interfaces for errors, drops, anything to point out the culprit. No errors on the interfaces, no incriminating drops, nothing. We start doing packet captures on the server and client to find MASSIVE amounts of unseen segments, out of order packets, dup acks. Error correction is obviously causing the slow moving inbound traffic.

I had the idea this morning on the way into work of testing without the VM/Windows environment being involved. I would add some data to the file server at our office then start a backup job to an appliance connected to the core switches. This would traverse the same path as SMB but not hit the FI's nor end on a VM. This worked perfectly. Now I'm really at a loss - We've had TAC looking @ it but that may take weeks to resolve. We've had several different engineers take a look also but nothing outside of "we need to capture at every hop". We are in the process of this but its taking quite awhile due to one side being managed by the data center staff.

​

If anyone needs more specific data or screen caps let me know.

​

I'm really starting to believe its something in the FI or VM environment but as usual have to defend the network first.

​

Here's a screen cap of Wireshark from the receiving server -

​

https://i.imgur.com/LdBd2Gd.png

​

Suggestions, comments, ideas, theory - all welcome here!

​

TL:DR - Inbound SMB/FTP traffic to our VM environment produces dup acks, out of order packets, and re-transmits. Switches and circuits check out. Moving data to a backup appliance vs a VM works as designed.

Blocking Windows 7 on Wireless or Firewall

Hey

We have a number of Windows 7 computers in our workshop that the team that uses them don't want to change. I have expressed my concern to them and went we don't care we need them our jobs. We to management and they agree they shouldn't be on our network

How can I block these machines? I have an idea what they are in DHCP so I can block their MAC from getting an IP. This fixes them getting an IP address.

How can I block them on the Firewall or Wireless Network?

They aren't on the Active Directory domain because they said it interferes with the programs we use

We use Sophos Firewall (XG210) and Ubiquiti Wireless Access Points

Is there a way that the Sophos or Wireless could detect what OS the machine it is and effectively block access to the network. They are connected to an SSID that has a WPA-PSK password. I can't change that password as a number of the RFID scanners use them on all the entries to the warehouse and office and we don't have access to the scanners to change them and getting them changed is a massive cost (someone has to come to our site and change them all).

That's another story but it was set up before I started and they had the same WPA-PSK wireless for everything before I started because it was easier.