Top-of-Rack Access in Spine-Leaf DC designs

Hi guys - so most spine-leaf architectural depictions that I've seen in vendor documentation, marketing materials, and educational resources are two-tier models, with access switches connecting to every core switch in typical Clos fabric. However, it seems to me that if you're using top-of-rack switches in the access layer, the L1 infrastructure required would get a bit out of control...

If we're looking at a medium-to-large sized DC, wouldn't it make more sense to design a 3-tier model where every TOR switch connects to 2+ EOR switches, and then those EOR switches connect to all the core switches in the Clos Fabric? You could still scale-out at the access layer installing additional EOR switches if needed.

If what I'm saying DOES make sense, then why isn't this sort of design commonly depicted? I mean, I know not every deployment will use managed TOR switches; some will have EOR only, others will have FEX (though isn't Cisco sunsetting it?), but my impression has always been that TOR tends to be the preferred design choice these days, at least in pods where do you don't have a bunch of large blade servers.

VPN tunnel is up, but it's not passing traffic.

This issue is driving me up the walls. I'm here to use the reddit hive mind to see if I can find a solution.

​

I have two ASAs. One in the US and one in Europe.

Tunnel is up. Both phase one and Phase 2.

​

1 IKE Peer: x.x.x.125 Type : L2L Role : responder Rekey : no State : MM_ACTIVE 

I also see SAs built. show crypto ipsec sa peer x.x.x.125 shows details for the SAs built.

The problem is that I can't ping across. Not just ping, any traffic. When I do a packet capture on the outside interface of both FWs, I see esp (proto-50) packets leaving US, hit, EU and leave EU but never get back to the US.

I can show you output of capture if you need it. What's strange is that this starts working randomly for like a day or so and then goes back down for a day or so.

Additional information is that the US ASA has several other tunnels that are working with no issues.

Has anyone had anything like this?

edit: one more thing. One packet out of like 100 gets through.

smokeping (from US) to a host on the other side of the tunnel. https://i.imgur.com/xV8II57.png

smokeping to the outside interface of the ASA is pure green.

Cisco UCS FI and 5548 MTU

We have a Cisco UCS setup with a pair of FI's and a pair of 5548.

MTU is set to 9000 on FI's by using QoS

and also followed the below commands to set the jumboframe on 5548's:

switch(config)#policy-map type network-qos jumbo

switch(config-pmap-nq)#class type network-qos class-default

switch(config-pmap-c-nq)#mtu 9216

switch(config-pmap-c-nq)#exit

switch(config)#system qos

switch(config-sys-qos)#service-policy type network-qos jumbo

After all this, I used sh queuing interface eth 1/17 to veirfy and I do get the following which confirms the MTU = 9216

RX Queuing

qos-group 0

q-size: 469760, q-size-40g: 0, HW MTU: 9216 (9216 configured)

​

Here's the question:

When I issue the command to check on the port-channel MTU size, I still see 1500 on the port-channel,

sh interface port-channel 101

port-channel101 is up

vPC Status: Up, vPC number: 101

Hardware: Port-Channel, address: 0005.73f2.eda8 (bia 0005.73f2.eda8)

Description: To FI-A

MTU 1500 bytes, BW 40000000 Kbit,, BW 40000000 Kbit, DLY 10 usec

Why is it still showing 1500? I thought the MTU setting should be global? Thanks!!

Difference between transport and ip transit?

Hi. I’m currently working in a ISP company, I’m new here, when we talk about our own ISP (all using optical fiber), I can’t see the difference between transport and ip transit, I’m a little confused. Could somebody help me to understand these concepts from an ISP perspective please?

Metageek 50% off promotion

Now is a good time to pick up some Metageek software. Their Pro stuff is 50% off. I just picked up Eye PA essentials bundle for $400.

F5 in the cloud ... why?

For those that use F5 in the cloud ... why do you do it? My org is really leaning toward just using AWS ALB/WAF in place of our current on-premise system. I'm trying to understand why this may or may not be a good idea. Is F5 even the best for hybrid if we don't end up going with AWS?

Has anyone done a password recovery on a Shunra VE?

I have one of these in my lab which I haven't used in 4 years. For the life of me I cannot get on the web interface. I've tried the default username/password of storm, and every commonly used password ever used in the lab. There is a reset button on the front that I've tried hitting once, and holding down with no results. I've googled it a ton and can't find anything useful other than the default username and password of storm. This is going to drive me nuts.

Do GPON NICs exist?

GPON networks normally end with an ONT device, which is normally an embedded Linux device with a bridge interface, bridging an Ethernet interface and the optical GPON interface. In this way the GPON interface is exposed as an Ethernet device to the router. All of this is often embedded in a SFP module.

Now, do "pure" GPON network interface cards exists, for example in the form of a PCI-e card? With such device I'd be able to connect the GPON fiber directly to a router, which will also act as a ONT, without an intermediate device.

A data wiping solution for Cisco devices?

Hello,

The company I am currently employed are paranoid about security to the point that they would prefer paying someone to dispose old switches instead of donating/selling them for cheap.

I was wondering anyone may know of a data wiping software that works on routers/switches.

​

Alternatively, i was thinking of downloading some open source text, like 10 articles and writing each one to the startup config. This will make configuration restore impossible for a hacker.

First homelab with Docker

/r/homelab/comments/g7tb45/first_homelab_with_docker/

Guide or baseline to choosing which interfaces to add netflow to?

Our new program is including 50 netflow sensors in our network monitoring. I have been assigned to choosing which Interfaces to add netflow monitoring to.

Right now, I am putting it on the core links, WAN, trunks between our distro switches, and some servers. I need to choose which interfaces would be critical to adding netflow. Was wondering if anyone could point me in a direction for guidelines and best practices into choosing these interfaces?

What VPN solution

Hi everyone,

What VPN solutions would you choose for a Global VPN deployment that had some requirements for users to access systems in the US and in Europe? Describe the approach to reduce latency for regional network access over the VPN.

Thanks,

Difference between disabling the 2.4 GHz network in a Cisco WLC and disabling 2.4 radios in APs ?

I've been seeing conflicting info on the web. I hope you can clarify.

The following steps will disable the 2.4Ghz Network in a Cisco WLC

1. Wireless > 802.11b/g/n > Network; 2. General; 3. UNTICK 802.11 b/g Network Status 

This command will disable the 2.4 GHz radio in an AP

config 802.11-abgn disable [AP NAME] 

What is the difference?

Is the disabling the 2.4Ghz Network enough? or will the radios in the APs still be on and broadcasting some kind of frames to the air?

Thanks

Huawei Course

Like other people said Cisco is the best and there are resources around the world easy access and tons of it.... i live in Cambodia which is a country in Asian. My firm and other firms in here is rarely use CISCO due to its price. So first I thought of getting into the CCNP but later decide to go with Huawei track instead. So I’ve been searching around for Huawei Study but I got no luck, the official Study with Huawei is Chinese and his English is not so good. I’d love some recommendation on Huawei course.

Give me your opinions and experience pls.

Sophos XG Firewall - SQL Injection and RCE Vulnerability Announced Today

/r/sysadmin/comments/g7ru9t/sophos_xg_firewall_sql_injection_and_rce/

Anycast & Corporate DNS; also, querying root-level servers directly?

Hey guys, I've got a couple of DNS-related questions for you all.

1. When you're hosting multiple authoritative name servers for your enterprise - perhaps in primary/backup or active/active data centers - would you typically anycast them to one logical IP address? Or can you register your domain as having multiple authoritative servers?

2. if you can have multiple authoritative servers, how does the TLD server decide which one to route requests to? Are there assigned levels of priority? Is it round robin? Are there any health checks involved?

3. Typically on your corporate DNS servers would they query all the root-level DNS servers directly, or do they need to route through your ISP's DNS servers / public DNS servers such as 8.8.8.8.

Sorry if these are stupid questions, I'm just trying to understand a bit more about how DNS is configured both on the enterprise side as well as the TLD & root sides. I've searched online and I can't seem to find any answers to this question beyond just the basics of DNS.

Pinging google but occasionally get request timed out

I've recently been having packet loss issues while playing games. My ping is fine, about 27-50 ms but every now and then my game just freezes completely, but then resumes after about 10 seconds. I thought that this was a bit strange so I decided to ping google in the command prompt. My ping is fine (33-56) but it times out every now and then.

Please help

DDoS protection for gameserver

Hello, I have a dedicated server that I am renting from a company called Webtropia. I use this dedicated server to run a gameserver for a community which has many players. Recently the server is suffering a lot of DDoS attacks and the server goes down.

I am considering my options on how I can prevent/mitigate DDoS attacks but I am new to this. My provider says that they offer DDoS protection but I am doubting the level of protection.

Can I use cloudflare on a game server, or should I switch to another dedicated server host with better DDoS protection? Any recommendations?

2 different public IP addresses

I am trying to setup a server from inside my home, but after I set it up and port forwarded, I tried to ping my server from outside my network, it timed out. So I went looked up my public IP address on Google to make sure I had it correct and went into my router to see if any settings could be blocking it, but when I checked my Public IP address from my router it was different. My external IP address that Google gave me was a 52.x.x.x and my router IP was 100.x.x.x. could this have anything to do with why I am having these problems?

Replacing existing Cisco ASA 5520 with pfSense HA Cluster

/r/PFSENSE/comments/g6yr9n/replacing_existing_cisco_asa_5520_with_pfsense_ha/

Transit provider route redistribution and IX peering

This is both a real situation and a hypothetical question, I want to understand what my upstream provider is doing (or could be doing).

I buy transit off AS2, who buys transit off AS3, who peer or buy transit off AS4. Everything is simple, my routes are redistributed.

Now I bring up a connection to an IX and peer with the route servers. AS3 is already a member of this IX.

+-----+ +-----+ +-----+ +-----+ | AS1 +---------+ AS2 +---------+ AS3 +---------+ AS4 | +--+--+ 100mbps +-----+ 10gbps +--+--+ 10gbps +-----+ | | |10gbps +----+ 10gbps| +-------------+ IX +------------+ +----+ 

AS3 now learns my routes from the IX with a shorter AS path, and if they accept them it would mean I get 10gbps to AS4 rather than the 100mbps I'm paying for. This obviously isn't the case, but I want to understand what they're doing to mitigate this.

If AS3 had a manually managed list of routes that they were meant to be accepting from AS2, and say marked them with a community string when they learned them, then redistributed to AS4 based off that community string - The route that's now in their RIB is learned from the IX and does not have that string attached, so the moment the IX route lands in their RIB they'll stop redistributing the prefix to AS4.

If they did this redistribution based off manually/API managed prefix lists egress to AS4, and my route was on that list, then they would redistribute my IX route and I would end up with 10gbps of bandwidth to AS4, when I'm only paying for 100mbps of transit to AS2 who also only pays for 100mbps of transit to AS3.

The only conclusion I've been able to come to is that AS3 must simply set a higher local preference for routes learned from paying customers. But that almost seems too simple, and doesn't cover off another issue;

Say I advertsied a /22 into transit and /24s into the IX. AS3 now redistributes the /22 it learns from AS2 to AS4, but when traffic reaches AS3 it would surely follow the more specific /24 routes to me via the IX.

Would AS3 filter the routes they learn from any downstream peering/IX, rejecting all prefixes and contained prefixes that customers (like AS2) are paying them to redistribute?

Need help with cat5e data module in wiring closet

Total noob here that could use someone's help.

Background: I previous had an electrician wire up a cat5e data module in my wiring closet to convert an RJ-11 (cat5e) line in my family room to Ethernet. He did it by running cat5e from my Verizon ONT in my garage to my nearby wiring closet and then stripped the line. Each individual wire was fed into the 2nd block (top left) of the 5e data module. He then used a cable toner to locate the family room line and then in the wiring closet converted it into an RJ-45 which he plugged into port 1. It looks similar to the below PDF on page 2, except the main line from the ONT is wired in, while the family room Ethernet is connected in Port 1 via RJ-45.

https://www.teledynamics.com/tdresources/ICC-ICRESDPA1Cdoc2.pdf

Current issue/looking for confirmation: Fast forward, I'd like to convert another RJ-11 port in the house to RJ-45. I ended up getting it to work but it doesn't follow the PDF above. First I unplugged the family room Ethernet cable and plugged in an Ethernet cable that went right into my router. I then connected my router to a switch. I then plugged the family room Ethernet cable into the switch. Now both the RJ-45 port in my family room and router in my wiring closet both work.

Did I do this right? Even though it's working it seems off because the ISP cat5e is punched into the module. That's the thing that's throwing me off completely. I'm happy it's working but it's throwing me off because I was expecting to have to use the other 7 RJ-45 ports on the cat5e data module. Confirmation and/or further details would be GREATLY appreciated.

A host can access the internet, but can't ping any host on its local network. When using tracert it looks like packets meant for local networks are being sent to the ISP. How to solve?

I'm currently setting up an email server for my job, and got it so I can send emails. But only when I'm using my data, and presumably other external networks. The server can be pinged, but it can't ping any device except the default gateway. When using tracert the packet will get to the default gateway just fine, but will then go on to the ISP instead of the intended target, where it appears to be discarded because it is a 10.x.x.x destination address.

I believe the router's routing table is incorrectly configured. My boss doesn't want me messing with router settings because the phone systems are set up there and the phone system cannot go down, so I would like some type of confirmation this is likely the case before we get the ISP out here. Any help is appreciated.

HP 2920 Redundancy with active/passive WAN links

Greetings! Rented a rack here in town, and fortunate enough to have a lot of time planning for failure now. Bought two HPE Layer 3 switches (HP 2928-48G) that are single PSU so I really have to make these guys failover to each other in case of issues (automatically).

ISP Demarcation are two RJ45s connected to Cisco Nexus 3000s that at any given time hands me a /28-subnet from any of those two RJ45s because they are set up with HSRP and with 1 virtual IP in my subnet.

In a perfect world I would've had enough of a budget to get two switches that can do VRRP but these cant. Refurbished stacking modules and cables cost the same as the switch, so I wonder if I'm really stuck having someone to drive to the DC and replug the "cold" switch in case of failure? 🤔Or do I have any other options?

EDIT: Added network diagram: https://imgur.com/a/3TNumcY

Setting policier on WS-C6504-E switch port

I have an ancient WS-C6504-E running 15.1(2)SY6 with SFP switch ports on a WS-X6848-SFP blade. We've never done any kind of QoS on this switch and unfortunately, IOS upgrades aren't an option at this time.

There are several WAN circuits terminated on this switch and I would like to configure some type of policier to limit bandwidth on the individual switch ports to the contracted bandwidth of the circuit to prevent any kind bursting or micro bursting issues.

What are my best options at this point or am I SOL?

Huawei Course

Need some recommendation on Huawei course.

Give me your opinions and experience pls.

I have to put all the fax machines (analog lines) into Call Manager

I have several Cisco VG202XMs with FXS modules.

I have some route and switch experience but not much. I've found a couple of sample configs out there, along with of course the requisite Cisco white papers for the VG202.

All these things need to be able to do is to facilitate faxing in and out.

Anyone have any juicy tips to share? Looks like we're using H323 in Call Manager and I should set it up that way if possible.

Honestly, I'll probably end up using a consultant for this in the end, but, thought I'd see if anyone had anything quick to share. I'd like to learn as much as possible even if in the end I need to turn to a specialist.

Cisco EVPN HMM Different MAC address

Hey all, this is a bit of an in-depth question regarding Cisco EVPN Fabric, HMM, and Multisite. Please bear with me while I try to detail the scenario.

So, within my EVPN fabric HMM works just fine, the VM pops up on a new VTEP the old MAC route is removed and the new one is added and traffic flows just fine. I'm having a problem regarding a VIP attached to 2 different hosts, HostA and HostB. HostA is in DC1 and HostB is in DC2.

HostA has an IP of 10.1.1.101 a MAC of 0000.1111.2222, HostB has an IP of 10.1.1.102 a MAC of 0000.2222.3333. The VIP is 10.1.1.100. When the VIP moves between hosts the l2vpn route gets added, but the old one stays in the BGP table. This makes sense since it's a different MAC address, but because of this the traffic to that VIP gets blackholed in the site that no longer has that VIP. That site still thinks that the route is local, and will continue to think that until it's finally removed from the BGP route table. I think that happens when the ARP entry times out on the old VTEP, but I'm not certain.

I've been googling around to find any details on this type of situation but have been unsuccessful. Has anyone else dealt with this, and possibly shed some light on how this should be handled?

Thanks!

Network upgrades during covid-19

I haven’t searched this thread to see if something like this has been posted, but curious to get thoughts on it. I work for a health care system and my manager is pushing our team to get depreciated replacements completed during this time. The thought process is for areas where we have finance/admin/non elective surgeries that it would be easier to get the downtime. We pretty much run chassis everywhere in our environment and racking/unracking a chassis by ones self is doable but difficult. My manager is pushing to put 2 people in a comm closet for the upgrade, there’s no way we can practice social distancing in a comm closet. He has even told me personally that it doesn’t matter if you wear gloves or not because the virus can be on your gloves or on your hands, doesn’t matter and you can be within 6 feet of people with a paper mask. Are others in networking facing the same issue? Would you work in a comm closet with a co-worker to replace network gear? Just curious to get some opinions on the matter

Exporting Prefilter Rules from Cisco FMC

Hello All,

​

I am having trouble exporting the list of prefilter rules from my FMC 6.4.0. I realize after researching that this can't be done either from the GUI or through an API call in version 6.4. So my only option is the CLI. In the CLI on the FMC I get a bash shell, and at the root directory I do a find . -iname prefilter* which returns a bunch of useless lib files and the likes, nothing that would help. As for the FTD device that hs the prefilter rules applied to it, that is just useless, I only get a rudimentary CLI, and when I do connect FXOS, can't seem to do much in there either. There is no 'expert' mode as some online results suggested. I am stumped at the moment, and frankly feel frustrated by this Cisco spaghetti mess. Can anyone help please.

​

-JJ

What should I upgrade ASR 1002(s) edgerouters

No NAT, IPSec, packet inspection, or firewall need. Just bare bones BGP.

We have two 1002 ASRs (Active/Passive design) that are just doing default routes through our BGP tables. We have two ISPs that we weight and failover through. They are just doing eBGP and iBGP. Just looking for suggestions on what would be a good replacement going forward. I have looked a lot at the ASR 1001-x and they are more than capable. Not really a fan of the pricing model and the overall cost. Looking to future proof. We currently are 2g through our primary ISP and at max for the future I would see us looking to do 10g so maybe a backplane capable of doing at least 20g.

​

We are a all Cisco shop (except for F5 and Palo Alto). I'm just trying to see if there is better tech. Lord knows it was a breath of fresh air going off of our ASA and ACE. Thanks in advance.

​

I have been following this so I assume we aren't far off:

https://www.reddit.com/r/networking/comments/g6nax7/20_gbs_wan_router_needed_cisco_asr_or_juniper_mx/

Simple replay of a pcap file from a server stream?

I want to run some tests on a client which connects to a simple server socket and receives a (unidirectional) data stream. It's pretty straightfoward - the 'server' is actually a serial-to-ethernet device outputting just a few bytes per second. But it's in a production system and I can't fiddle with it much.

So I've used tcpdump to capture some sample data from the live connection, and I'd really like something which will pretend to be the server device: ie. listen on a socket, and when it gets a connection will play back the relevant payload data from the pcap file at the same rate, but to whatever test client is making the connection.

I can write this myself, but I felt there must be something off-the-shelf which could be made to do this. I don't think, though, that tcpreplay or tcpliveplay will... anyone know anything else that might?

How to manipulate the metric from Ezvpn?

Hi All,

Would like to know your inputs about this issue that I'm facing right now. So I do have 1 Cisco router configured as ezvpn client and I also have another private circuit with bgp connected to it. Both Peering (from bgp/ezvpn server) advertised a default route now since route from ezvpn has administrative distance of 1 and bgp has 20.

What would be the best solution for this?

- If i change the distance from bgp then it should be lower that 1 (not sure the minimum distance in bgp) but I think this is not the best solution.

- Set this command "reverse-route distance xx" on ezvpn but I'm not quite sure if this should be configure on server or client ezvpn (still checking).

​

Thank you

Time zones

Hey everyone,

I was wondering what your thoughts are on time zones. If you manage devices accross the globe, is it best practice to have all routers and switches use UTC time zone?

The argument for using local time zone to the switch would be for easier troubleshooting with local technicians.

The argument for using UTC across the globe would be for logging and coordination of all devices.

What do you all think? Is it better to have all global devices use the same time? or have all devices use a local time for that device?

SFP DDM stack-overflow (8.16 dBm)

A couple of years ago one of the networks i admin got a batch of defective plugs where the DDM didn't seem to work correctly. Otherwise they function perfectly.

When you try to poll the DDM from them, both Tx- and Rx-power always reported 8.16 dBm. Seeing as they worked, and the next batch didn't have the problem we acknowledged the problem with the vendor and then promptly forgot about the problem.

Today while discussing some troubleshooting steps with a couple of new hires this problem was mentioned by them. I casually dismissed the problem with "it's a hardware bug, don't worry about it! It's probably a translation-issue inside of the plug".

After this I went over a conversion-table from mW to dBm, and noticed this:

6 mW = 7.7815 dBm 7 mW = 8.4510 dBm 

I then wondered what 8.16 dBm maps against in mW:

8.16 dBm = 6.5463 mW 

That's awfully close to 2¹⁶ so i translated that into dBm:

6.5536 mW = 8.1647 dBm 

From what I can gather from the above information, the mW-counter seems to be 16-bits long, and seems to either be stuck to 0xffff or there is a stack-overflow happening.

I just wanted to share this with you guys, and ask if you've encountered something similar to this before? If so, please share! I found this issue extremely interesting!

Need help with moving from legacy metro-ethernet to sd-wan

Okay, I need some help with changing my DCs over from Legacy Metro-Ethernet to Hybrid with SD-WAN.

I'm relativity new to SD-WAN, so I have a good idea what I am doing, but not enough for what I am trying to do.

I'm having a hard time wrapping my head around exactly what I need to do here. There is a ton of documentation out there about SD-WAN, but not a lot of working examples or working configuration examples to go off of. All I ever find are pictures with no background to them.

​

I have included 3 attachments:

My Current cEdge config (cleaned) that is an ASR1001X running SD-WAN

A L3 routing diagram of where things are currently connected

A diagram that I found on the internet that is almost exactly what I am trying to accomplish.

https://www.dropbox.com/sh/6t7thbzhbyuvsng/AAD7OTJrD1TQBzv0_l5GC8ANa?dl=0

​

Currently my cEdge has 3 ports built:

G0/0/0 - VPN0 is direct to the internet

G0/0/1 - VPN1420 that connects directly to my Metro-Ethernet and my legacy sites

G0/0/2 - VPN1420 that connects to the corporate LAN

​

Right now, I can have a vEdge on the color public-internet and it works great, but I want to bring in SD-WAN into the metro-ethernet, but I can never get away from having a few sites that will always be legacy. Or at least for a few years.

So, I need to add a G0/0/3 - VPN0 that connects back into the LAN and can listen for TLOC from the metro-ethernet.

But this is where I am lost.

The picture I have with the hybrid is close to what I am trying to do, but not exact. On that one, they have VPN0's reversed for what I am trying to do. I already have legacy on G0/0/1.

My thought process here is to add a /30 from G0/0/3 to my switching core network, advertise it in OSPF, so that it will be reachable from anywhere, even my metro-ethernet. Then when I add a SD-WAN site. give it an IP address on the legacy metro-ethernet, and then it should be able to make a connection to the other side because they would be able to find each other and have the same color?

Anyone out there help me out?

Calix CMS

Does anyone know how to get a config dump from either the CMS app or the e7's in a scriptable way? I tried oxidized and while it worked great for everything else i tried it on... it didn't work for the calix line... I just want to be able to do a config backup of all the calix devices so I can diff them and see what changed etc over time...

fields in influxdb

hi i recently configured netflow on my router and i collect them with pmacct and save them into influxdb. in influx when i type show field keys, it prints:

fieldKey fieldType

bytes float

and when i type show tag keys, it prints:

tagKey

etype ip_dst ip_proto ip_src port_dst port_src tos

when i config my router to work with netflow, i create template like this:

match ipv4 tos

match ipv4 protocol

match ipv4 source address

match ipv4 destination address

match transport source-port

match transport destination-port

match flow direction

match interface input

collect interface output

collect counter bytes long

collect counter packets long

collect transport tcp flags

collect routing next-hop address ipv4

collect ipv4 source prefix

collect ipv4 destination prefix

collect timestamp sys-uptime first

collect timestamp sys-uptime last

as you see, i collect lots of different things but the only things i have is bytes

my question is why the only available field in influx is bytes and how can i have more fields?

Thanks.

What can cause reproducible disconnection after 20 seconds in certain clients

The situation: Some devices seem to have sever connectivity issues. They seem very deterministic, as a reconnect to the wifi yields exactly 20 seconds of internet/home net connectivity. After that, I usually can't access neither the internet, nor my router (!).

I am fairly stumped by this problem. I have some basic debugging skills (arp -a, traceroute etc.) but with this problem I don't even know where to start. What could cause the computer to lose the connection not just to the internet, but to the home router? And always after around 20 seconds? I suspect IPv6 to play a role here, but I don't understand how that is handled by ISPs right now deeply enough. Can you give me any pointers? Maybe to articles about ipv6 and the transition period we are in right now? Maybe pointers on where the problem could lie? Many other clients connect without problem, so it's probably not the router

CISCO UC540

Hi. I have obtained a Cisco UC540 and Cisco IP Phone 7940 series to start my home office. I know a fair bit about networking etc but I am having serious issues trying to get the IP phone to provision??!

does Engenius use PoE standards?

/r/HomeNetworking/comments/g6yuke/does_engenius_use_poe_standards/

IX peering

Are there any disadvantages to trying to peer with as many as possible at a public Internet eXchange? Asking for a friend.

Forcepoint NGFW Question with Softphones

Hello,

I am trying to get softphones on our NGFW but am running into issues where the firewall is dumping the connection because it thinks the VPN tunnel is getting spoofed. I tried to set up a SIP port range with a client VPN voice network rule but am still getting the spoofing message. Has anyone else tried this or had any luck? I really do not want to allow all ports over SIP

Can I use SD-WAN for internet fail-over from ISP A to ISP B at our primary site?

Hello,

Here is my scenario...

We have a medium sized private data center, this site is connected to the internet through a single ISP provider. This ISP gives us a block of IPs we use to publish various services to the internet (Exchange, Lync, VPN, Citrix, and our LOB applications).

Couple of internet outages go by and I am now pressed to find a redundant solution so that our site does not go dark when our ISP has an issue.

Searching around I keep ending up at SD-WAN solutions (bigleaf.net, aryaka.com, zscalar.com catonetworks.com, etc..) but I know very little about SD-WAN and it seems to be there are different types of SD-WAN providers (on-premise, cloud, backbone etc.).

I can get internet services from a 2nd ISP provider so that we have redundant ISP providers, this would ensure the last mile is also redundant and protect us against local line cuts.

I would need to be able to "bond" both ISPs together in a fail-over configuration and it seems SD-WAN can do this for outbound traffic.

What I can't wrap my head around is how the IP addressing is handled. If I have 2 different ISPs and 2 different set of IP addresses, how is the IP switching handled?

For example if Exchange's autodiscover DNS records are configured to resolve to IP from primary ISP, the secondary ISP IPs will be different. How can Exchange continue to work? This is just one example of the many other apps users need access to by IP or DNS.

I did came across BigLeaf (https://www.bigleaf.net/same-ip-address-failover/) and they market themselves as a SD-WAN provider, and on that page it seems to provide a solution to the exactly problem we are trying to solve.

Because with Bigleaf, when one of your Internet circuits has an outage, you don’t. Your IP address doesn’t change. Your VPN, remote desktop session, SSH session, VoIP call, Web Presentation, and every other application stays up!

So it sounds to be that some SD-WAN providers are able to provide a solution to our question.

Anyone have experience using SD-WAN solutions to provide both inbound and outbound fail-over and address our "same-ip-address-failover" requirement? I would like to come up with a short list of providers to reach out to for further discussions etc.

In case anyone suggests, I know we can keep the TTL on our critical DNS records low and update the IP addresses in case of outage, but this is not what we want. Looking for an automated and seamless solution.

Thanks for your help.

Blogpost Friday!

It's Read-only Friday! It is time to put your feet up, pour a nice dram and look through some of our member's new and shiny blog posts.

Feel free to submit your blog post and as well a nice description to this thread.

Note: This post is created at 00:00 UTC. It may not be Friday where you are in the world, no need to comment on it.

Firewall Vendor Transitioning

I've put up a blog post to give others an idea of how to perform a migration of firewall vendors. I've performed this multiple times whilst moving to Palo Alto clusters and the transitions have gone very well. The main selling point is using this method it avoids the need to have either:

1. Change freeze
2. Perform a complete swap out in one period of downtime

https://ip-life.net/firewall-vendor-transitioning/

Telnet password IS encrypted

I am just trying to test telnet connection (using one real pc and one virtualized) and I configured a telnet connection between them.

​

Now, I tried to capture telnet packets using wireshark. When I went to "follow TCP route" after logging to another pc through CMD I can see the password - it is encrypted - but it should not be, right? Passwords should be encrypted in SSH...I am kinda lost atm, anyone who could help me with this please?

Question regarding Azure Global Traffic Manager

This question may be a hybrid between systems and networking but I thought I would ask. I'm thinking of using Azure traffic manager to load balance our anyconnect VPNs. We have 2 sites, a primary and a DR site both with ASAs. We were doing some load balancing based on round robin DNS. I was thinking of using Azure's traffic manager instead. I have it set up - set up in fact was very simple.

Azure instead of giving a public IP to work with, provides a DNS name instead. You're suppose to update your CNAME record with the traffic manager address. This is where I get a little confused. We have an A record currently that points to our primary ASA. Do we still keep that A record once we add a CNAME? and then wouldn't traffic just go straight to our ASA without touching the load balancer in Azure?

this may be better asked on the systems side but thought I would post it here first since what I'm trying to do is essentially networking-oriented; plus these days (unfortunately) we have to deal with DNS as well. :)

TLIF - Upstream Link Detection

I understand what it does. I dont understand why you would use it. Can someone tell me like I'm five? Keep in mind I'm a Collab guy, so just because I have a CCIE doesnt mean I know every product portfolio.

Enabling Command Authorization on Cisco ASA

Hi all, first of all, very grateful to this community for all the help you've provided to me over the last few months, so just wanted to say thank you.

Second, I wanted to get some confirmation on what I'm going to attempt to do tonight. I want to create a read-only account for my ASA, and I think I can do this by enabling Local Authorization (this particular ASA is standalone and not using RADIUS).

If I have a privilege level 15 admin accounts, and some level 2 user accounts for VPN, and a single level 5 account that I want to be read only, I shouldn't run into any problems enabling this, right? My understanding after reading this morning is that it will simply enforce the privileges, so it won't lock my level 15 accounts out or anything.

I plan to do this in ASDM via Device Management>Users/AAA>AAA Access>Authorization>Check the "Enable" box and select "Server Group: LOCAL"

In the Configure Command Privileges Setup window when I temporarily check that box (without Applying) I should just change Command "running-config" in mode "exec" with variant "show" to privilege level 3 and I should be all set, without needing to hit the "Set ASDM Defined User Roles" button since I don't want it to create those Admin/Read-Only/User predefined roles.

Does this sound right to you guys? Am I missing something and about to lock myself out? Thanks for the help once again!

Junior Network Administrator Path?

Hello Networking Community,

I currently am a college senior in information systems graduating in December and am looking to get into a jr. networking admin role or something of that nature. Currently I work as a Software Developer Intern and have been for the past two years, but I want to switch into a Networking role which will get my foot into the door for Cyber Security; preferably as a IT Security Specialist, Incident Responder or a Cyber Security Consultant. My plan till graduation is to learn basic linux, get a certificate in Coursera's Google IT Support Specialist and get my CCNA. Would this be enough to get me into a role as a Junior Network Administrator? I'm trying to get these certs to boost my knowledge on networking and put it on my resume, especially since I am not coming from a support background. I live in the Tri-State if that helps. Do you think this plan is a good one or is there a different route you guys would take? Thanks.

Anyone Using Nectus NMS?

While looking for a Solarwinds alternative I came upon Nectus. I searched and there is nothing in /r/networking and I was curious if there was anyone else using it or demoed it? nectus5.com is the webpage it has a lot of similar modules to Solarwinds and then some but a very minimalist design. I can't find anything out about the company behind the product though.

20+ Gb/s WAN Router needed -- Cisco ASR or Juniper MX

Greetings All,

I would love a little feedback from the community. In an enterprise environment, would you look at the Cisco or the Juniper hardware to do your WAN routing Most likely OSPF but possibly BGP. Stability and bug free/reliable is of utmost importance.

Thanks.

SFP+ connection question

Hello fellow network engineers,

I do have a question about SFP+ which drives me a little crazy. My boss has bought two Huawei Oceanstor 5500v3 storage systems and one Huawei OceanStor SNS2124 fibre channel switch. The Huawei storage systems uses these FC adapters: Huawei 8.5G-850nm-0.15km-MM-SFP+ (PLRXPL-VC-SH4-HW) and the Huawei FC switch uses these FC adapters: Brocade 8G FC SWL 850nm SFP+.

Those two systems can connect en communicate with eachother but I would like to connect a Windows HOST to the Huawei Storage with Fibre Channel.

I have a Mellanox Connect-X2 card installed in my Windows HOST but that host cannot connect nor communicate with my Huawei Storage system or Huawei Switch. I have used both the FC adapters with the Mellanox Connect-X2 card but no result whatsoever. When I add another Mellanox-X2 card to my Windows HOST I can connect them to eachother without any problems.

Do I need other FC adapters for my Mellanox Connect-X2 cards or is there something else I'm missing?

Issues with Workforce Call Recording on 8811 IP Phone over VPN

Hey everyone,

Hope you all are staying safe and keeping busy during the epidemic.

I am currently attempting to troubleshoot an issue with some Cisco 8811 IP Phones not recording their calls.

Currently all of our users are working remotely and the vast majority of them are using Cisco 7841 IP Phones registered over Cisco Expressway, and those phones have no issues when it comes to recording their calls.

We have three remote users that are using Cisco 8811 IP Phones connected via the built in VPN client on the phone to a Cisco ASA. I have verified that the call recording server as well as the other collab servers are able to connect to the 8811 phones over the VPN, so network reachability is not an issue here.

The 7841 and 8811 are setup identically on the CUCM with the exception of the additional VPN configuration for the phones. Otherwise everything else is setup exactly the same for the users and phones on all the other servers.

We do not have an IM&P service deployed if that matters at all.

As far as I can tell, none of the 8811 phones have successfully been recording the agents calls on the recorded line.

I do have a ticket open with TAC for assistance and have begun providing them with information, also I do plan switching these users over to Cisco 7841 IP Phones in the near future, but I’d like to see if I can get this issue resolved quickly as recording these agents calls is very important.

Thank you

Georgia Windstream Outage

Looks like there was a fiber cut thats causing internet and T1 circuit issues for at least Windstream customers. Happy Thursday!

Is there a way to do a trace route, but get more detailed information?

Just curious if its possible to do a trace route, but instead of seeing only IPs, see more detail like routing protocols, AS numbers, etc.

Is Something Weird happening with the Internet this morning?

We have had strange routing problems since around 1 AM on both our Local ISP and ATT circuits. Doing a lookup on some of the IP addresses we get from trace routing places them in different European countries. To add to this, the ARIN whois lookups seem to be failing. Has anyone else noticed anything?

Installing custom software on router from UPC

Hello guys!

I have new router from my ISP(UPC), and they gave my old router (UBEE EVW3226) for my own use.

They install own software on these routers, but so i have this router for my own personal use, is there any way to install own software and create from this router some kind of access point?

This something like this https://shop.optiwella.com/modem/ubee-evw3226-wireless-and-voip-cable-modem

Buying used Cisco - what `sh` output should I ask the seller for?

There's plenty risk buying gray market gear online. How do you make sure you get it right? sh license and sh int status seem like obvious ones for most Cisco gear. For PoE switches, I could also think of sh power inline. Have I missed anything critical?

I'm most curious for switches, in particular.

Matching up the console output to item photos seems like a safe strategy.

L1 Switch with BGP

I would like to understand the architecture to configure BGP on an L1 Switch (Metamako or Exablaze).

Couple of options are suggested:

- Send BGP from a separate L3 switch

- Send BGP requests from the host (Linux server)

I would appreciate any suggestions, pros/cons on the above methods.

Q | Looking for tool which can build a packet buffer and send chosen packets at a set interval

I have been looking for a way to use Linux’s Network Emulator to do this job on a bridge.

I want to achieve having a variable ex. ”Interval” with a value of ex. “20ms”, and with some extra scripting to target packets we get the following result:
- Packet A received: 10:10:30.007
- Packet A sent: 10:10:30.020

- Packet B received: 10:10:30.021
- Packet B sent: 10:10:30.040

- Packet C received: 10:10:30.032
- Packet C sent: 10:10:30.060

This way we can force consistency on the packets we are forwarding.
- Is this already possible to achieve with existing tools?

Thanks
/AMNAS

Brocade VE routing

I have current configuration:

vlan 2000 by port
untagged ethe 1/1/46
router-interface ve 2000

interface 2000
port-name test
ip address 10.20.20.1 255.255.255.0
ip ospf area 0.0.2.0
ip ospf passive

And somehow I am unable to get this network up and routed, what gives? Does the port need to have a cable connected to come up and start routing? That sounds weird to me though.

ISR1111 vs ISR4331

What's the key differences between ISR4331 and ISR1111?

I have 50 L2TP VPN Clients, few ipsec tunnels, 100-200 hosts in LAN.

My goal is to reach 1Gbps NAT Throughput. As my research says I should be fine with ISR1111 but friend of mine said that I should go for 4331 instead. Any ideas why? :D

Can an 8 bay NAS encloser run two separate Raid 6...setups

Noobie here, I'm looking at the Synology DS1817 to backup video files from my 4 Samsung SSD's year-round (total of 4.5TB's of storage).

I believe that I want to run them in Raid 6. I don't care about write speeds, mostly read speeds.

I am looking at the 1817 because of its 10gbe port. I edit videos sometimes in 4k and just want to make sure that I could edit videos off of this if I needed to (it will primarily be used as a backup, I will typically edit off of my Samsung SSD's). If 10gbe is overkill let me know, my videos are over 1gb per minute however this could be used in a group environment where multiple people would access it.

I will typically shoot about 8-10TB's of footage a year so this NAS enclosed with 8 4TB hard drives could last me two years. I would prefer to be able to relegate 4 of the 4TB hard drives to one year at a time. My ideal situation would be to have 4 hard drives be only 2019 videos in the enclosure while writing new data to 4 new 2020 hard drives. That way I would still have access to my 2019 videos in an accessible archive while writing to a new set for the new year.

Is this possible in a raid configuration or would the data be spread across all 8 hard drives at once?

I would imagine that this would be a software issue and that some NAS enclosures could not and some could but does anyone know the answer? I've been trying to do as much research as I could before asking this

Add non-Cisco device to Cisco DNAC

Hey folks,

Can we add non-cisco switches in DNAC through discovery method for assurance, management and monitoring purposes?

Any feedback ?

What does connectivity to your branch sites look like?

Mainly this is what I’m getting at- how many folks are running bog standard business internet connections and using firewalls for site to site VPN.

Versus

Using expensive Ethernet circuits such as ELAN and the like and using a technology like macsec for encryption over the carrier’s network.

Looking for ideas - BGP Internet Routing

Hi,

I’m a Network Architect with about six years programming experience. I’m currently learning Angular frontend web framework and I have experience with developing backend (API/scripts etc.). My process of learning is to build something useful in parallel to learning the theory.

Anyway, I decided to focus on the theme of BGP/Internet routing/security since it’s a hot topic. I have a few ideas of my own, but I would love to get some suggestions about useful features I can incorporate.

Currently I’ve got: - Summary of current status for a given ASN (including prefixes, advertisement status, neighboring ASNs/upstream providers) - Live/recent BGP events for a given AS or prefixes - Detection/alerting of BGP route hijacking/invalid advertisements and other incidents - Auditing/compliance report, with a focus on security

There are some really good websites out there already, like ripe.net that present extensive information. I’m hoping to obtain suggestions about issues or challenges that are not already covered so I am simply not reinventing the wheel with this project. I would be happy to host the site/solution for others to use, maybe I can solve a problem you have... please let me know.

Thanks!

QoS Settings for Cisco Jabber

Good day to you all.

I am testing Jabber for my organization, and I've noticed we have some quality issues when making calls out of Jabber instead of the phone.

I have some class maps built on the voice vlans, and with the help of the auto qos voip cisco-phone command on my access switches I am able to get traffic shaping across the network for the network with the switchport voice vlan command.

How can I achieve the same over the data vlan?

vSAN Stretch Cluster + Mellanox

I’m going to put my cards on the table here. I’m a VM admin that’s a little out of his depth. My company is looking to implement a vSAN stretch cluster over two racks in our main factory. The partner has positioned two SN2010M and 4 vSAN nodes to go at each side of the factory. What I don’t understand is how to stretch the layer 2 network over these two racks? It can’t go via the core as it doesn’t support Jumbo Frames.

My plan is to create an MLAG for each of the two switches then run a cable (250m OM3) between the uplink ports of each set of switches removing the need for a Spine switch. My question is, How do I stretch the layer 2 network between these 4 switches?

FYI - the vm traffic will go straight into the core so thankfully there’s no need to worry about that.

Promoting a secondary instance - Cisco ACS

Hello - New to the networking field. Just a quick question about ACS 5.4.

I need to update a secondary acs to be the primary.

Under ACS -> System Administration -> Operations -> Distributed System Management

Do I just need to select the secondary instance and promote it? Or is there some pre-work that needs to be done?

Cisco RMA & Serials

My boss just told me to RMA a knowingly not under warranty switch but to use the RMA of a switch we are using that is under warranty. I am assuming they check the serials and bill us when they take them back, right?

Any suggestions leave a note "sorry"? I dislike my boss who threatens/insults to fire my coworkers & I so I am not willing to do him any favors.

If you someone here tells me they check the serials I can make my boss know this fact and stop his dishonesty.

Seeking help with industrial network security issue

Sorry if this is against the rules or not the place to ask, let me know and I will remove.

I am not a networking guy but need to implement the requirements below. Any help is appreciated!!

Topology: https://imgur.com/a/mniDv5a

Requirement:

• Remote connection must be able to access devices A,B,C
• Remote connection may not access Network A
• Network A must be able to access device A. Don't care if it can also access devices B, C.

​

I can change IPs, subnets, have access to a layer 2 switch and and a layer 3 router, but don't know where to start on coming up with a clean solution for this. VLAN with NAT? Simply subnetting?

​

Thank you in advance!!

Redoing network, subnetting vs vlans

I am planning out a network reconfiguration of one of our facilities. It is a large warehouse and I didn't properly plan ahead and used 3 class C networks which have quickly filled. I plan to move to a class A network broken up into internal ranges. Currently we have 3 physical interfaces used on our firewall for LAN, WLAN, and VOIP, each of which have a class C network assigned. We will be keeping the physical separation buy I want to separate each physical interface to have multiple /24 networks (DHCP, guest, Management, Servers, Printers, etc). I am unsure of the most effective way to go about this. I was considering VLANs but am not very familiar with implementing them. The other option was simply subnetting the Class A into smaller subnets for each interface and manually controlling the ranges. What would make the most sense while being fairly simple to implement?

RAD MIRICI-155 alternative deivce?

Hey All,

Is anyone familiar with a alternative to the following device?

MIRICI-155

https://www.rad.com/products/Pluggable-PNFs-SFPs/MiRICi-155-GbE-over-STM-1-OC-3-SFP-Converter#page1

​

Thanks in advance.

Async routing VPN box

Setting up a new VPN box. This is slightly seperate from our existing main internet link (same outside subnet).

Any issues to watch, or is it a big no-go to async route all outbound traffic to the main internet link, and only allow internet.

​

Effectively route statements will be :

route inside 0.0.0.0 0.0.0.0 {gateway}

which should result in a route table of:

S* 0.0.0.0 0.0.0.0 [1/0] via {inside gateway}, inside

C {isp IP} 255.255.255.0 is directly connected, outside

How does everyone label their cables in the data centre?

Hi All,

Due to the ongoing pandemic, I've found time to look at such exciting things as my company's naming conventions for cables. I've been wanting to change way we label/name cables in our data centres for a while as currently it's a bit of a mess.

I'm curious to see how other organisations go about it. Looking online there are of course ISO standards for such things notably ISO 14763-2 I think (there is an ANSI equivalent TIA-606-C but me being based in Europe I'm hesitant to use an American standard). Has anyone had experience with these, are they worth implementing? The ISO standard is behind a pay wall and I don't think I'm quite at the stage yet where I'd consider buying it.

I'm curious to know people's thoughts, any assistance is appreciated. Thanks!

Water Vs Ethernet

Morning everyone, I don't have a ton of experience with networking but had a quick question, we have many wall ethernet ports spread out throughout my company and I responded to a complaint that an ethernet port wasn't working only to open it up and find it covered in water. Do I have to change the entire wire or just the female port? Normally I would replace the whole cable without question to be safe but this particular spot will be hard to feed wire to again.

HELP - Mac and IP issues - ARP table on switch

i have been trouble shooting an on going issue with what i believe is an ARP table conflict

basically we have 2 CRM Production servers that are load balanced and this load balancer ip is 192.168.1.189 and the MAC lets just say is 12345. there are 2 public switches in HA (vpn gateway too) that then point to 2 cisco FTDs in HA which then points to the DMZ and internal network

when a user goes home. connects to their home network they often get a 192.168.1.189 IP address and it just so happens that 2 users have NICs tht are also saying their MAC is 12345.

this is where im lost.

when these users come back into the office. the ARP table on our cisco FTD is getting confused and routing all external traffic/ VPN traffic to that client laptop which doesnt respond and everyone gets 504. anyone on the network or DMS is able to use CRM fine. i amguesinig because it doesnt route through the FTDs which are jacked up some how.
yesterday we reset the ARP table time out / refresh and it resolved the issue. get ran ipconfig /all and verified that these two users laptops have the same IP and MAC as the CRM loadbalancer

what can i do here? not a networking guy

Unable to Get Into ROMMON Cisco Catalyst 9300L PoE

I have a new Cisco Catalyst 9300L PoE that I did a factory reset on. When I reboot the switch it goes into this mode:

switch:

I am unable to get into ROMMON mode for some reason. I also tried to TFTP the latest image via TFTP server and get "Write access to "flash" is unsupported.

Current ROMMON image: Primary

A few other items:

flash: ro flash

bootflash: ro system partition

​

Any assistance would be great!

Thanks,

Network Design Validation and Suggestions

I have to re-design a firewalled design and add F5 & DC Firewall in the network

I put together a fairly average network design in the link below, so we can talk about this.

https://imgur.com/a/0MraD7i

I just need to know required traffic flow (direction, south-north or east-west), pattern.

My assumptions and queries

​

- Core network would have default route to DC switches to get to internet and Servers. Access to servers would then be controlled by DC firewall.

- DC Switches would have default routes to DC firewall.

- I want to add F5 for internal network as well.

- I understand that for traffic flow in from the internet to servers will hit internet edge firewall and the Firewall will DNAT traffic to F5 on virtual IP's and F5 will source SNAT the traffic to DC. Palo Alto DC Firewall would then control the access to servers.

- How traffic from the internal network to servers in the DC will if I add same F5 in the network path.

What's best practice here ? I would appreciate any feedback and suggestions

What's better CWDM/DWDM or using more fibers?

I work at an ISP and we are looking to segregate our local markets into their own networks, right more it all operates on one large erps ring. We are considering multiple wavelength or expansionary network cards. The cards and sfps wil cost like 30k - 40k but offer a lot of room for growth in our largest market. I have no idea the cost of multiple wavelengths equipment but that's our consideration.

We have the fiber to just expand easily without multiple wavelengths. Can anyone provide real pros and cons of cwdm/dwdm?

Replacing Fortigate80E with Ubiquiti suggestions?

Hi Guys
(quick overview of network)

2 WAN lines from a main and backup ISP run into a Fortigate80E firewall. The firewall is directly connected to a UBNT gigabit layer 3 EdgeSwitch 48-Port EdgeSwitch which handles core switching and does have L3 capabilities. This switch then connects out to 11 smaller access switches that go out to banks of desks. The company has roughly 150 users atm and will reach 200 by the end of the year. There are no on prem servers and almost all traffic will be voip, web browsing and accessing files off cloud storage. We also have about 10 unifi pro AP's and 2 cloud keys that manage wireless networking.

My manager has requested I look into replacing our current Fortigate80E firewall with an offering from Ubiquiti. (The current firewall isn't under enormous stress, this is more for future-proofing project and hopefully being able to centralise management around a ubiquiti console)

My first thought is seemingly the most powerful firewall offering from Ubiquiti is the USG Pro 4? However, from what I have read it doesn't seem more capable than a Fortigate 80E? maybe more of a sidestep, besides the obvious advantage of centralized management with the current switch and ap's.
I was also thinking for a company of this size, surely it would be better to have a separate firewall and router to deal with core routing. Perhaps a USG Pro as the firewall and maybe another Ubiquiti router to handle the majority of internal routing??

Any thought appreciated :)

Wireless AP Image version.. need help

Hi guys,

I need some help on figuring out what version of the software my AP is currently running.

When I do "sh ver" this is the output I get.

Cisco AP Software, (ap1g4), C1832, RELEASE SOFTWARE Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2015 by Cisco Systems, Inc. Compiled Sat Nov 24 22:01:12 PST 2018 ROM: Bootstrap program is U-Boot boot loader BOOTLDR: U-Boot boot loader Version 30 APA4B4.3940.6200 uptime is 0 days, 0 hours, 6 minutes Last reload time : Sun Apr 5 00:32:40 UTC 2020 Last reload reason : Factory Reset --More-- cisco AIR-AP1832I-K-K9 ARMv7 Processor rev 0 (v7l) with 997268/793556K bytes of memory. Processor board ID KWC24050151 AP Running Image : 8.5.140.0 Primary Boot Image : 8.5.140.0 Backup Boot Image : 0.0.0.0 1 Gigabit Ethernet interfaces 2 802.11 Radios Radio FW version : f6d58b5e05c762162e07fe70e0671647 NSS FW version : NSS.AK.C.CS-3-fix2 Base ethernet MAC Address : XXXXXXXXX Part Number : XXXXXXXXX PCA Assembly Number : XXXXXXXXX PCA Revision Number : XXXXXXXXX PCB Serial Number : XXXXXXXXX Top Assembly Part Number : XXXXXXXXX Top Assembly Serial Number : XXXXXXXXX Top Revision Number : XXXXXXXXX Product/Model Number : AIR-AP1832I-K-K9 

All I know from this output is that the current version of the image is 8.5.140

How do I know if the AP is running a lightweight image or ME?

Netflow implementation strategy

Hi I recently configured netflow v9 on my routers. I collect them with pmacct and write the data to influxdb and use grafana for showing the collected data.

I create my template like this:

Match ipv4 dest address Match ipv4 src addresa Match udp src port Match tcp src port Match udp dest port Match tcp dest port Collect counter bytes

Now that i have configure netflow i have lots of questions!

What fields should i collect in my template to have enough information about my network?(like who uses the network traffic most?- how much of WAN utilization is unneccessary traffic?)

Where should i locate my exporter?

Number of exporters?(in network with more than 400 users)

Which interfaces should be monitored?in which direction?

Any answers will be appreciated

FCoE experience

Good day Comrads!

Will be appreciated If you share your experience about FCoE ( Fibre Channel over Ethernet )

• How long you use it ?
• Any problems with stability ?

Question about stateless NAT64

I followed this post to play with stateless NAT64. I can ping the 192.1.1.1 (2001:DB9:0:1::C001:101) from R1 just fine. However, from R2 I can't seem to ping 2001:DB9:0:1::C0A8:502, which I think is the translated R1's 192.168.5.2 address. Is this correct? If yes, is there something missing in the config?

R1#ping 192.1.1.1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.1.1.1, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 3/4/5 ms R3#ping ipv6 2001:DB9:0:1::C0A8:502 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2001:DB9:0:1::C0A8:502, timeout is 2 seconds: AAAAA Success rate is 0 percent (0/5) 

Zoom alternatives for China

Does anyone know of an alternative to Zoom that can be used both inside and outside of China?

Netperf/Flent test servers - Anyone know of ones that are up?

/r/HomeNetworking/comments/g5skjr/netperfflent_test_servers_anyone_know_of_ones/

Wake on lan through external network

I need to be able to wake up a PC using wake on lan for remote access, but I am unable to configure port forwarding through the router, is there a way I could route the magic packet signal through an Android phone on the same network as the computer without screen mirroring the Android phone?

Rant Wednesday!

It's Wednesday! Time to get that crap that's been bugging you off your chest! In the interests of spicing things up a bit around here, we're going to try out a Rant Wednesday thread for you all to vent your frustrations. Feel free to vent about vendors, co-workers, price of scotch or anything else network related.

There is no guiding question to help stir up some rage-feels, feel free to fire at will, ranting about anything and everything that's been pissing you off or getting on your nerves!

Note: This post is created at 00:00 UTC. It may not be Wednesday where you are in the world, no need to comment on it.

Over hauling HTTPS Inspection policy those with experience how did you organize your policy?

Specifically using Checkpoint.

Old policy is a jumble of individual rules mixed with categories, mixed with applications, mixed with IPs (And there's a lot.)

I'm thinking that dumping all the sites that don't play well with into a custom application that has them as a list instead a single rule. Then adding categories then applications (predefined and custom) beneath that.

However reading over best practices I don't actually see a lot of information on the best method to do this... Rather don't mix applications with pre-defined categories.

EG: Dropbox AND "file storage/sharing"

Our rule base grew to cumbersome thus causing it to go on the fritz and in some cases inspect bypass objects or not get inspected when it should have. (Still happened with R80.30)

​

Thanks for the help in advance.

How often do you update the firmware/ios on switches and firewalls?

I'm a fairly new net engineer so I'm interested to hear how others handle this. Most of our infrastructure was replaced within the past 2 years, so all cisco switches and ASAs are fairly new.

How often do they need to be updated? How do you keep track of new releases and determine whether or not you should update?

For example most of our Cisco 3750 switches are on 12.2(55)SE10, is that current enough? Is it time to update?

Smokeping alternative

Is anyone aware of Smokeping alternative?

It seems a bit old and rather limited to functionality.

​

I am looking for an open-source tool which can graph latency from different points by logging into those remote hosts (via SSH) and testing.

​

Thanks!

FPR4100 FXOS subversion in v.2.6 train

We are running FPR4100 and we need to upgrade it to v. 2.6 train.

is anyone running FXOS v. 2.6(1.192) ? Have you encountered any bugs in this version? This is the latest cisco release and I haven't found any officially posted bugs yet.

If anyone is running any other subversion(s) of 2.6 train on FPR4100, can you let me know which subversion you are running and if you are having any issues?

thanks

B

Recommendations for MIB compiler

I was using IBM Netcool MIB Manager to compile SNMP MIBs however my new computer cannot run it. Does anyone have any recommendations for a good compiler (online or free preferred)?

Routing to vagrant VM.

Newbie to networking here. I have vagrant VM running with docker installed and I need to ping the containers from the host machine(mac). I have the following route table in my mac.

Routing tables

Internet: Destination Gateway Flags Refs Use Netif Expire default 192.168.8.1 UGSc 91 3 en0 127 127.0.0.1 UCS 0 0 lo0 127.0.0.1 127.0.0.1 UH 5 36653 lo0 169.254 link#15 UCS 1 0 en0 ! 172.30.1/24 link#21 UC 2 0 vboxnet ! 172.30.1.1 a:0:27:0:0:1 UHLWIi 1 10 lo0 172.30.1.5 8:0:27:13:d9:12 UHLWI 0 17 vboxnet 204 192.168.8 link#15 UCS 0 0 en0 ! 192.168.8.1/32 link#15 UCS 2 0 en0 ! 192.168.8.1 ec:89:14:2a:64:1e UHLWIir 33 336 en0 1194 192.168.8.100/32 link#15 UCS 0 0 en0 ! 192.168.100 link#20 UC 1 0 vboxnet ! 192.168.100.1 a:0:27:0:0:0 UHLWIi 1 12 lo0 224.0.0/4 link#15 UmCS 2 0 en0 ! 224.0.0.251 1:0:5e:0:0:fb UHmLWI 0 0 en0 239.255.255.250 1:0:5e:7f:ff:fa UHmLWI 0 84 en0 255.255.255.255/32 link#15 UCS 0 0 en0 !

Following is the routing table of my VM

vagrant@vagrant:/$ route Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface default _gateway 0.0.0.0 UG 100 0 0 eth0 10.0.2.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 _gateway 0.0.0.0 255.255.255.255 UH 100 0 0 eth0 172.17.0.0 0.0.0.0 255.255.0.0 U 0 0 0 docker0 172.18.0.0 0.0.0.0 255.255.0.0 U 0 0 0 docker_gwbridge 172.30.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1

172.30.1.5 is the IP address of the Vagrant VM and the 172.17.0.2 is the IP address of the Docker container that's inside the VM. How do I do that?

TCP ignore delayed packets due to RTO

TCP ignore delayed packets due to RTO

I am looking for a functionality in tcp for a situation and the explanation goes as follows.

Let us say there are 2 hosts H1 and H2.

H1 sends 20 packets P1 P2 ... P20 to H2 in 20 milliseconds but due to some issues in the medium P3 was dropped. Due to congestion H2 was not able to send timely acks and H1 waited till its timeout of 1 second to resend a segment containing P3 and once that new retransmitted packet containing P3 was received by H2 all old packets upto P20 were actually processes by H2.

The issue here is that H2 processes data delayed by 1 second due to inherent properties of tcp stack. I wish to not let this happen because 1 sec is just way too much of a delay for me and I want H2 to somehow ignore all packets from P3 to P20. Is there any way I can make this happen? Let us say I want to keep the connection alive as well. Is there any uncommon functionality in tcp that can let me do this?

Diference between 'Service instance 1 ethernet' and 'Service instance trunk 1 ethernet'

Hello, im using ASR 920 and I need just a trunk port, and I wonder what's the difference between using this method:

service instance 100 ethernet

encapsulation dot1q 100

rewrite ingress tag pop 1 symmetric

l2protocol peer cdp stp

bridge-domain 100

service instance 200 ethernet

encapsulation dot1q 200

rewrite ingress tag pop 1 symmetric

l2protocol peer cdp stp

bridge-domain 200

or this other:

service instance trunk 1 ethernet

encapsulation dot1q 100,200

rewrite ingress tag pop 1 symmetric

l2protocol peer cdp stp

bridge-domain from-encapsulation

I already test it with port channel but the second option take down the link. Thanks for you advice.

Level3 Outage Chicago

Anyone else on legacy Level3/CenturyLink fiber having issues this morning? Just opened a ticket with CenturyLink and the rep told me that they're having major issues in Chicago, which is right were I see tracerts go to die.

1st time poster - long time lurker. Thought I'd throw this out there as a heads up to others.

Cradlepoint on a pre-paid SIM?

We have a Cradlepoint AER1600 inbound via FedEx, should hit my loading dock in a few hours.

Working for a large company we have purchasing rules, regulation, and procedures for everything, and it's all bound in Red-tape. Enter COVID-19 and stuff grinds to a halt while everyone figures out how to do there job.

IE, I can't get a SIM card thru our regular channels for a few weeks, but I need this cradlepoint functional this week, or it will cost our company a major contract.

Is there any Prepaid SIM card I could just buy and put in a Cradlepoint and have it work? (I know it has to be a 2FF size SIM). Searching the sub, I see people mention T Mobile, but when I contacted them (Doing business as Simple Mobile?) the say they do not allow this. I tried a few others, same answer.

Neighborhood ISP

This is my first time posting here but I have a question on some network related things and thought this was a good place to start. In my area, there is only one ISP (for wired connectivity) and they charge a ridiculous price for a not so great service. For a (much) larger fee I can have fiber run to my home by an ISP on the other end of town offering 1GB/1GB up/down. My question is, am I allowed to split that up into multiple 50/50 or other various connections and charge people in my neighborhood a small, monthly fee for the connection? This would cost me a lot up front but if I take that hit now and most of the people, who I have already spoken to and would be willing to switch if another provider was in the area, were to sign up for say 20$ a month for the 50/50 (which is cheaper and faster, ~50$ for a 25/3 normally) then it would make up for it over time. Monetary concerns aside, would this be legal? I can go apply for a proper business license (my home is already a business address for another side business I do) and register as an LLC but am I missing anything here? I just hate big ISPs preventing others from coming into the area.

What is the status of Multipath TCP?

I'm really excited for the future of MPTCP, but I haven't heard anything about it in a while. How far out is this standard from being implemented? I'm I right to assume that it would allow for my phone to use wifi and mobile data at the same time?

eve-ng lab strage packet loss

I have build this EVPN + VxLAN lab - https://imgur.com/a/4WGjbNH

I am just testing L2VNI (L2 layer) functionality and its working but only problem is from server-1 to server-5 i am getting packet loss but if i ping between server-1 to server-3 i don't get any packet loss, is this qemu gitch or some configuration issue? I have shut down Spine-2 switch also to not do ECMP but still very strange, did anyone noticed this kind of behavior

python newb here, but I have a use case and want to try python.

Let me start off by saying I have zero experience with python, but I have a scenario where I think python can be used.

I'm not sure if a GUI needs to be involved or if this is all done via CLI, but I'd like to use python to ssh into a switch run a handful of commands, wait a few seconds and run a few more commands and exit.

Something along the lines of

ssh [ip of switch] and credentials enable conf t interface gi1/0/11 shut power inline never 

short pause

no shut power inline auto exit 

Something along those lines. I would like it to be interactive in order to input the correct IP for ssh (including credentials) and being able to modify the port. As you can see, all this is doing is a power cycle and shut/no shut of a single port. I'm assuming a front end is also built with python that would contain the fields and when a button is pressed the commands are executed once the ssh session is created. I could be way off base here, but that's what I'm picturing.

Am in in over my head with having zero experience? The most I've done with python is followed a video showing someone creating a python script that displays Hello World! or something like that.

Thanks.

Reseting ISE CLI admin password from a hyper-v

Hello all,

My admin password of the ISE CLI has been locked by the ISE, I am trying to reset it but I cannot find any useful steps for the hyper-v since all the documents are for the virtual box.

Any help, please.

thank you.

ACS Options

We're possibly in the market for a new ACS, as in TR-069, 181i2, etc. I don't see much ACS talk here, save for the "how does my ISP provision me?" questions.

Wish list items are API and brandable customer Android/IOS apps for config and things such as device usage monitoring and scheduling (think kids). Captive portal for installers would be cool.

We've seen the newly acquired NISC solution, but what else are you using? Are you rolling your own apps? Open to commercial and maintained open source solutions.

Network security in modern data centers; is this a common and/or acceptable design?

I think we're all familiar with the traditional Cisco-approved DMZ design. You have a pair of DMZ L2 switches that trunk multiple VLANs up to an HA pair of edge firewalls. The edge firewalls provide inter-VLAN routing and connect the DMZ VLANs into the main data center fabric. To me, this seems a bit antiquated.

In a modern DC, why not go with a design that looks more like this:

• Firewalls connect to the DC core using Layer 3 interfaces, relying on either static routing or an IGP such as OSPF.
• Instead of trunking up VLANs to the Firewall, put them into VRFs and align them to an FW zone; perhaps separate ones for External Internet, Internal LAN, Public Web, Private Web, App/Backend, and Infrastructure (non-user facing).
• All intra-VRF traffic goes through a firewall, whether that be external user to web, internal user to web, web to app, App to DB, etc. Traffic within a given VRF could be segmented with ACLs in the DC fabric if needed.

This way you're securing more than just the private as well as public resources, as well as front-end to back-end traffic. You can provision public resources anywhere you want in the DMZ; you can make use of L3 routing protocols; and if you need physical isolation you could still dedicate certain racks and/or physical servers to be restricted to a certain VRF.

What do you think? Obviously, if you need microsegment and secure a lot of east-west traffic something like ACI or NSX would be a better way to secure your environment, but this seems like it could be a perfectly acceptable design in a more traditional deployment.

Draytek 2960 hacked?

The syslog have this following. Is it hacked ?

<141>Apr 20 05:20:30 Vigor: pptpd[12538]: accept client 141.98.81.42, socket[5]...

<141>Apr 20 05:20:30 Vigor: pptpd[12538]: MGR: check initial connection socket: 5 OK...

<141>Apr 20 05:20:30 Vigor: pptpd[12538]: CTRL: inetaddr[0]: 58.152.89.118

<141>Apr 20 05:20:30 Vigor: pptpd[12538]: CTRL: inetaddr[1]: 141.98.81.42

<141>Apr 20 05:20:30 Vigor: pptpd[12538]: CTRL: Client 141.98.81.42 control connection started

<141>Apr 20 05:20:30 Vigor: pptpd[12538]: CTRL: Made a START CTRL CONN RPLY packet

<141>Apr 20 05:20:31 Vigor: pptpd[12538]: CTRL: Asked to allocate call id when call open, not handled well

<141>Apr 20 05:20:31 Vigor: pptpd[12538]: CTRL: Set parameters to 10000000 maxbps, 3 window size

<141>Apr 20 05:20:31 Vigor: pptpd[12538]: CTRL: Made a OUT CALL RPLY packet

<141>Apr 20 05:20:31 Vigor: pptpd[12538]: CTRL: Starting call (launching pppd, opening GRE)

<141>Apr 20 05:20:31 Vigor: pptpd[7902]: CTRL (PPPD Launcher): program binary = /usr/sbin/pppd

<30>Apr 20 05:20:31 Vigor: pppd[7902]: Plugin /usr/lib/pppd/2.4.3/localip.so loaded.

<30>Apr 20 05:20:31 Vigor: pppd[7902]: LOCALIP: plugin initialized

<30>Apr 20 05:20:31 Vigor: pppd[7902]: MOTP: plugin initialized

<30>Apr 20 05:20:31 Vigor: pppd[7902]: Plugin /usr/lib/pppd/2.4.3/dhcpc.so loaded.

<30>Apr 20 05:20:31 Vigor: pppd[7902]: DHCPC: plugin initialized

<29>Apr 20 05:20:31 Vigor: pppd[7902]: Init buildin plugin /usr/lib/pppd/2.4.3/connect_status.so

<141>Apr 20 05:20:31 Vigor: pptp[7902]: Plugin /usr/lib/pppd/2.4.3/pptp.so loaded.

<141>Apr 20 05:20:31 Vigor: pptp[7902]: PPTP plugin version 2.4.3 compiled for pppd-2.4.3, linux-2.6.23.5

<141>Apr 20 05:20:31 Vigor: pptp[7902]: The remote system is required to authenticate itself

<141>Apr 20 05:20:31 Vigor: pptp[7902]: but I couldn't find any suitable secret (password) for it to use to do so.

<141>Apr 20 05:20:31 Vigor: pptpd[12538]: pppd[7902] process is not there ?? clear this call.

Fast Ethernet SfP on a fixed Gig SfP port.

Hi Guys, Stupid question can I get a Fast Ethernet SFP to work on a fixed Gig Ethernet SFP port? The switch is Cisco.

Directed graphs for network diagrams from excel file with IPs and ports?

Looking for something which could intake an excel spreadsheet, with the following format:

source IP | dest IP | TCP port

where the rows could contain duplicates (e.g. one source may have multiple destinations, one per row)

and output a directed graph network diagram?

Many, many years ago I recall using something like dot and a Perl program, but can't use Perl, anymore, otherwise I'd try to dig up that solution. Are there any new developments in this space, allowing for excel intake (in any format) and output-ing network directed graphs?

Cons of Working at a Vendor?

Ive had a couple opportunities that ive turned down before to work at vendor but recently ive been eyeing the idea of trying to work at one. My only issue is loosing my skills in other vendors or having to learn some platform that said vendors sells but may not be a good product.. Those of you who currently work at one, what are some of the cons you experienced ?

nexus peer-gateway function without HSRP

/r/Cisco/comments/g4w9zy/nexus_peergateway_function_without_hsrp/

Can you hide your up address from wireshark? VPN on but wireshark still sees my real internet IP help!

My Mac is using the hotspot from my iPhone. Both amc and iPhone have VPNs. When I look at wireshark it shows my real internet (hotspot) up address.

I’m no tech guru by any means but I thought my vpn would hide this?

Any help or explain to me otherwise. Thanks

Is IKE ID set by zone on a firewall?

I have a virtual Palo Alto in AWS and the untrust interface has a 10.x.x.x IP address. It also has an elastic public IP assigned by AWS for that untrust interface. I need to build an IPsec VPN to a customer who also uses the entire 10.x.x.x/8 network internally.

Can they set their IKE ID to our 10.x.x.x untrust interface IP in some sort of VPN zone on their firewall so it is segregated from their internal 10.x.x.x/8 network?

Nornir, Ansible or Prime for config mgmt

Hi guys, I am a network engineer who has been using python libraries for simple network config changes or show commands. The libraries I have used in production are netmiko and paramiko both with multi-threading when I need to run a script on multiple devices faster.

I have used ansible In a virtual environment but not production. I’m not to strong in Linux at the moment so I use ansible in a virtual Ubuntu environment so I don’t break my production.

I am currently learning Nornir and liking it more than ansible.

My job wants me to automate network configs back ups/ schedule them. They don’t want to buy solarwinds NCM and want me to try using our current Cisco Prime software. I don’t really like it and prefer NCM. Is it worth using Cisco Prime and learning it. Because I would rather go the either the Ansible or Nornir route and I feels it has more flexibility and it’s open source.

I plan to make a web api flask or dgango so that others in my Dept can use the python scripts without having to know the backend.

What do you guys think? Learn Prime and do the config mgmt/scheduling with it or continue with the python based scripting. Also which is more recommended right now Nornir or ansible. I am biased on which one so would like opinions from those that have been down this road already.

Routinator guide

Hi guys,

I'm looking for a guide to setup routinator on Debian and can't seem to find a proper guide. Honestly I haven't had the patience to go through it fully but was still hoping somebody to point me to one they had used or written to help me get going and finish the job.

Even though I'm not taking full routes and I have rpki setup with apnic, it seems like a good idea to have a source validator.

Thank you.

Issue with ICMP Redirect Host same VLAN different Subnet

Hardware: Juniper QFX5100 for layer 2 vlans. MX240 for layer 3 + routing.

Topology: Layer 3 MX240 -> Layer 2 QFX5100 -> Servers

I have an issue with servers on the same VLAN rarely occurring where TCP connections are being interrupted/lost.

The two servers are on the same VLAN but are on different subnets i.e. 10.10.10.2/24 and 10.10.20.2/24

A workaround I have found and currently implemented for some cases is to split the servers onto different VLANs.

However this is not possible for the current issue I have where it is actually two virtual machines on the same physical server but on different subnets. (I'm aware I can make a virtual adapter on local IPs so it doesn't go back to the switch/router but that's not fixing the issue).

This is not restricted to just one particular VLAN.i.e. vlan 2 with server A and B has an issue with losing remote MySQL connectivityi.e. vlan 3 with server C and D has an issue with server C's mail not being passed off to server D with a "no route to host" error.

When I ping between subnets I see the following "redirect hosts"These example subnets are /29's

64 bytes from **.75.122.252: icmp_seq=2 ttl=63 time=0.406 ms
From **.75.121.121: icmp_seq=2 Redirect Host(New nexthop: **.75.122.252)
From **.75.121.121 icmp_seq=2 Redirect Host(New nexthop: **.75.122.252)64 bytes from **.75.122.252: icmp_seq=3 ttl=63 time=0.405 msFrom **.75.121.121: icmp_seq=3 Redirect Host(New nexthop: **.75.122.252)
From **.75.121.121 icmp_seq=3 Redirect Host(New nexthop: **.75.122.252)

There are no firewall filters in place on the VLANs,

Any suggestions where to begin to look in resolving this would be greatly appreciated.

Recommendations for replacing an old Cisco 1803.

My company still has an old Cisco 1803 router in use for a broadband connection. Because this router has been end-of-life for a loooong time already, I want to buy 2 new ones (one for production, one for spare).

However, I'm not quite familiar with entry level Cisco routers that support PPPoE. The current 1803 is connected via FastEthernet to a provider CPE. When I look at the config of the 1803, it's pretty basic with PPPoE and a Dialer interface, and some NAT config.

Can anyone recommend me a solid alternative? It doens't need to be a Cisco device. I personally prefer Aruba, but I can manage IOS devices as well.

Backup Business Internet

GoodMorning, Reddit!

My question is one of finding a backup internet provider for my work. It's a fairly simple setup. We have your typical ethernet connections spread throughout the office, and 5 Ubiquiti APs running off a heavy duty PoE injector switch. That being said, is there any particular secondary internet service you guys have had great luck with? Whether it be a business class hotspot style setup or what not, I'm looking for recommendations to keep the Docs happy when our primary goes down. I hope that's enough info, but if not, just scream in all caps at me for more details :-)

Help: Mellanox ConnectX4 100gb throughput

I have a home lab with two 8 core 2.4 ghz Xeon servers with two ConnectX 4 100gb single port cards and mellanox qsfp cable. I’m trying to make sure I’m getting maximum throughput between the machines using ib_send_bw and bidirectional I’m getting about 165 gbits, where I would expect closer to ~190. Is 165 more typical of this setup?

CPU Xeon (Haswell) 2.4 8 core v3 OS: Ubuntu 20.04 (kernel 5.4 generic / low latency) Driver/Firmware: OFED 5.0 Hardware: PCI-E 16x (verified with mlnx_tune and lspci), c states disabled, p states using intel Network: direct plugin MTU 4096 Test: ib_send_bw bidirectional, duration 10 sec, rdma

I have noticed that ib_send_bw seems to be single threaded? One machine has a single core maxed out. Is this interrupts? I’ve never had that issue with cards like these

I considered switching to CentOS 8.1. Had better luck with CentOS 7.x with enterprise networking stuff and Mellanox states the 20.04 Ubuntu driver is “beta”. I need eventually to have ZFS support, which Ubuntu just seems easier.

ISP slowness, investigation finds no issue

I have been getting a lot of random slowness from my 3 ISPs at my data center reported by outside clients. When we open tickets with the ISP we see there traceroute data coming through they review and find nothing wrong. Are there any tools or requests I should be making of the clients or the ISP to actually find out the problem? When I review the logs and port stats from my equipment I see no issues as well.

First Entry to a True Enterprise Setup

Good day everybody.

This one is long. TL;DR - I am redoing the Wi-Fi at my work, currently there is home routers acting as access points all joined together with 100 down and 6 Modem providing it all. Looking for input how to replace it equipment that can handle the load of 300+ people at peak times.

I was going back and forth between homenetworking and networking to make sure I am in the correct sub but with how big my setup has to be I assume I would end up in this one. I will try to include as much info as possible.

I have dabbled with enterprise gear for my home lab but haven’t done a full setup for a commercial environment before.

My situation - I am in the navy stationed in guam and I have been designated for redoing the public Wi-Fi through out certain locations in the ship. There is roughly 300 users that will be on it during the peak hours.

How it is setup currently (You might chuckle a bit):

It starts with a 100 Down 6 Up Cable modem (Highest speed offered on the island) with a Linksys EA9400 Home Router that has two Cat 5E Cables coming out of the LAN Ports. This is in a public office space and Game Room. This sees about 35 people max.

The first CAT 5E cable goes from that router to a AC1700 TP-Link C20 home router in the gym a level below. This space sees about 25 People max

The second CAT5E cable makes a long 400+ feet run to a large eating area (Mess Decks) where roughly 250 people at one time can sit and eat. That cable plugs into another AC1700 TP-Link C20. That router in the eating area then has three more CAT5E cables from it.

The first cable runs another home C20 Router in a Lounge area. About 20 people will be in the space. The second cables goes to a Linksys EA7300 and that is in a officer eating area (Ward Room). This one will be going away soon since the officers are going to get a second modem for themselves. The third cable goes to nowhere and is assumed dead. (Tracking it down tomorrow)

To top it off, there is a random Wi-Fi booster attached to router in the public eating area (Mess Decks). No idea who is using it.

So my plan is to start from scratch. Whatever purchase plan for equipment will have to be presented to my commanding officer to get approval for purchase.

Since this will be a Wi-Fi only network, I will be relocating the Modem, Router, and Switch to help get even distribution of the new Ethernet cable.

As for new equipment, I was considering a Ubiquiti setup. I just trying to plan for when I detach from this ship and future growth for the network.

Edgerouter X (ER-X-US) Unifi Switch 8 60Watt (US-8-60W) 5x AP-AC Lite (UAP-AC-LITE)

Every public space will get 1 AP with the large eating area 2. One for each side of the room.

I hope I didn’t cause too much a headache asking for help. I am no means a professional and my local IT’s are just providing new cable and tools since most don’t know as much as myself (I am mechanic at work, Nerd at home)

Thank you and any advice is welcome.

Anyconnect Split Tunnel Teams - "Failed to Send"

Hey all,

Bit of a long shot but i was wondering if anyone has experienced the "failed to send" error on teams when split tunnelling on anyconnect? (or any vpn client). We are seeing a very small number of users experience this whilst the bulk of the organisation working with no issue.

We've split using their recommended approach using IP blocks and specific domains which ive listed below:

access-list split-tunnel-ips standard permit 13.107.64.0 255.255.192.0 access-list split-tunnel-ips standard permit 52.112.0.0 255.252.0.0 access-list split-tunnel-ips standard permit 52.120.0.0 255.252.0.0 anyconnect-custom-data dynamic-split-exclude-domains teams_traffic lync.com, teams.microsoft.com, broadcast.skype.com 

This is then applied and taking effect correctly.

Thanks in advance.

Cisco Nexus GNS3 licensing.

Hi all,

​

I was wondering if there is a way to run a fully licensed Nexus switch on GNS3. As far as I am aware, licensing works on "some" GNS appliances (IOU), but I have not seen anything in regards to Cisco Nexus.

Can I get a temp license for vNexus or do I have to purchase VIRL?

SD-WAN - Configuration Question

Hi all. We want to setup an SD-WAN in one of our offices. I've never dealt with SD-WANs before so was hoping someone can advise if what I think we're supposed to do is right/wrong:

​

1. Hook up the SD-WAN box between the ISP router and firewall (Checkpoint in our case)
2. Assign the SD-WAN a public IP address
3. Change the S2S VPN IP from that of the firewall public IP to that of the SD-WAN public IP
4. Change the default route of the firewall from the ISP gateway to the SD-WAN box

We're currently using Checkpoint's ClusterXL so we also have external switches that hook up both firewalls in case of failover so that's causing a bit of confusion as well.

Happy to elaborate if needed, I just want to get a grasp on this.

Network devices.

Hello r/networking(new member here) I am self studying data communications and I would ask for recommendations for a good book or a website for network devices(modem, hub, bridge, switch, router, gateway). I started researching on them individually on the internet, and I observed they have identical functions which confuses me a lot. And, if they have almost the same functions, why is there no all-in-one device in the market that have all the functions of a network device.

Open-source application detection

Hi,

So say I want to sniff network traffic and use the packets (not the ports) to identify applications, has anyone stumbled across an open-source application that can do that?

Thanks.

Richard

ERSPAN filter on Nexus 9300 to filter out GRE packets

Hi, as the title says I am trying to craft an ERSPAN filter that excludes GRE traffic. The intent is to limit the capture of other ERSPAN traffic flowing through device.

I have looked at Cisco documentation and tried to apply a filter as below but it hasn't been successful.

Has anyone made something like this already?

monitor session 20 type erspan-source filter access-group filter_gre

vlan access-map filter_gre 5 match ip address filter_gre_acl action forward

ip access-list filter_gre_acl 10 permit tcp any any 20 permit udp any any 30 permit icmp any any

When connected to an IX, why do larger orgs prefer bilateral peering ?

[For background, I look after a small AS connected to a few public IXs]

I have noticed that many larger organisations who are connected to an IX, do not use the provided route server for multilateral peering.

They often have an open peering policy and are happy to connect using the layer2 IX connection, but require establishing a direct BGP session between the two parties.

What are some of the benefits of bilat over the exchange link that make it preferable for these companies to avoid participating on the route server?

EDIT: Apart from just being curious, it caused me to wonder if I should remove our own AS from the routing server.

Cisco NTP server behavior

Hello,

I need some clarification regarding how NTP works in Cisco devices.

So right now my client wants to use one of their 6500 series switch as their internal NTP server for development network, but it doesn't seem to work at the moment.

As I understand, 'ntp master' command is needed for router/switch to act as a NTP server, but my colleague says it's not needed.

What I want to know is that if the router has an external NTP source configured (ntp server configured, but no ntp master), would it be possible for other switches to use this router as a NTP server?

Sorry if the question is hard to understand. English is not my first language. :p