Under qualified and can’t track down an issue

Hello! I’m sorry if you guys get these pleas for help a little too often. Also, If I’m breaking the rules please let me know.

I work in a very small IT office and we are having connectivity issues. The last couple of weeks have been a constant flow of tickets about Internet slowness. We’ve added a few new items/processes that may be sucking up the bandwidth, but I need cold hard data to back it up before I propose a solution.

As I stated, I’m severely under qualified to be assessing the functionality of a Cisco ASA. I can access ASDM 7.9 and see some basic stats, but nothing that screams “I’m dropping packets like crazy in favor of this other traffic.” CPU and Memory seem to be less than 50% utilized on average. The firewall seems to show dropped packets, but I think it’s referring to the SYN attacks being dropped. Even our ISP sent a report saying that our connection was under utilized

Any assistance would be wonderful.

I know we need a networking professional to come in and assess this setup with all the cloud changes we’ve had, but management is non responsive. I’m all for letting it burn to the ground and forcing their hand, but that means in the interim I’m working weekends replying to these tickets.

I would like your feedback on my design plan

Hello r/networking.

So a little background. I am a business owner who is expanding my business and hiring more employees to meet our current workload. I have no Networking experience. In the next coming weeks, I will begin the process of building my office network. I have been doing a lot of research in the last few weeks and I have a general understanding of the process.

I am very intimidated, I won't lie. I know if I continue my research, and ask questions to different communities, and take my time, I can't fail. But I made a network design I would like your feedback on. All parts are label and will be used to implement.

Thank you and I look forward to your feedback.

My design plan

Trendnet Arp table

Does any one know how to get the 'arp -a' output on a Trendnet TPE-5028ws?

Automatic VPN failover when I am only allowed one tunnel

I have a vendor that has a strict one-VPN tunnel policy: they allow me to have a single VPN from their Amazon cloud presence to my network, no more, end of discussion. Why? I don't know why, they just won't budge, they say it is more secure and easier to manage that way. The contract was signed with them before I joined the company, it cannot be renegotiated or terminated for at least another 7-8 years, so they are the ones I have to work with.

At my site I have two internet connections - one Comcast business, one local fiber provider. The VPN to the vendor routes over the fiber connection, and if that goes down I lose the tunnel even though I still have internet access across the other provider.

Let's say my public Comcast IP is 192.168.1.1 and my public fiber IP is 192.168.10.1

What options do I have to provide a single IP address of, say, 192.168.50.1 that will serve as my endpoint for the tunnel (complying with the vendor's requirements) and from there route over the fiber connection if available or the Comcast connection if not?

I've dabbled looking at SD-WAN, but can't find even a ballpark price for service beyond some companies saying $15,000/month and other companies saying $150,000/month but those numbers just don't seem right to me, and have no idea if it would even help me out in this situation.

A variety of options would be helpful so I can compare advantages/disadvantages and, of course, cost.

Looking for Recommendations for a Cable Tester/Tracer (~$100)

I am not 100% sure if I am using the correct terminology. I am trying to trace some Ethernet wall jacks and see where they go and if they are work. I would also like to test coax cable as well. Here are a few pictures showing what I will be working with. I want to test these in my garage and also in each room.

Does anybody have any good resources on how to create a virtual networking lab?

I am looking to practice networking by making my own virtual labs and then document my progress for my future employer.

My end goal is to become proficient enough to become a network support technician.

Thanks for the help guys!

Which vendors give free access to firmware updates? And under what terms?

PoC and test-equipment time is coming up again, but I don't always know what to expect from vendors we haven't used, or haven't used recently. Can we make a list of vendors who offer access to updates without current maintenance contract, and the terms under which those updates are offered?

For example, I think it's still true that Cisco offers an updates without contract when a CVE has been identified in a previous version. I hear they need to be contacted about it specifically in order to release a given update to a given login account, but I don't have any first-hand experience with that. Even setting up and verifying an account is more trouble than just downloading files.

Geographic Maps

Are there any good tools or resources (preferably free) to map several IPs to a geographic location and map them out on a globe? I have found a couple free sites from quick searching but they do not allow more than one at a time.

What is the bottleneck for Fibre to the home connections

As people are spending more and more time at their homes the internet speeds are dipping. I have heard that the optical fibre cable (fibre to the home) has a very large bandwidth capacity. Yet I find my internet speeds to dip to 20% of actual at peak hours what could be the bottleneck it certainly doesn't look like the fibre cable.

How hard is CCNA?

2nd year networking student here, from Ireland Dublin. I've a few questions I guess after being informed the other day by my networking teacher how hard it actually is but I'm not sure if he was being dramatic about it.

My networking teacher told us the CCNA is one of the hardest IT exams you can possibly take, with high failure rate for first attempters.. I googled it and one google source said 95% failure rate for first attempters? Of course I take this with a pinch of salt and don't fully believe it.

But my networking teacher has 3 master degrees in IT and CCNA already and has stressed over and over this is the hardest exam you ever take.

Is he serious? Should I really be uping my study levels for this exam?

In Ireland to take the CCNA already is like 800 euros, i dont wanna imagine taking such an incredibly hard exam at such a price point and fail it?

If i get my degree in networking, is CCNA still vital to getting a decent job?

Thanks.

(Vague questions I know, just not sure where else to ask)

Can't access Apache server from another device

Hi I'm new to networks and all that stuff, and trying to install a webserver for website i installed Apache and all this thing and i can access it from the same machine (in the browser localhost or the ip)and it work but cant access it from my phone any help ?

I did the port forwarding and nothing changes

Auto Create / Delete VLANs

Is there a protocol on switches that enabled automatic creating and deletion of VLANs based on VLAN packets? We have a campus where we have about 400 VLANs configured on every core and access switch. APs are using VLAN tags to put the wireless users on the proper VLAN according to their radius authentication. This means that every uplink and access port is configured as a trunk port with all 400 VLANs tagged.

We never know which user is going to be roaming to which access point, so we need all enabled.

I would love it where when the AP sends a packet with a defined VLAN tag, then that VLAN would be added to that port as a tagged Vlan. After a certian timeframe of not receiving a packet with that VLAN ID, the vlan would be removed from that port.

GVRP seems to be a solution. Its supported on the switches we use (Brocade / Ruckus ICX), but I am not sure if the Ruckus AP's support this?

Nobody does IDF closets anymore?

Wanted to throw this out there to see if you've seen the same thing recently.

Several of our customers have constructed new buildings or done massive renovation to existing buildings. By massive, I mean that they gutted in the inside of the building, no interior walls left, totally new floor plan.

In initial planning (which we were thankful to be included in), we gathered requirements on number and location of devices and came up with a port placement diagram and proposed IDF closet locations.

However, none of our customers have ended up giving up the square footage for an IDF closet. In every case, they've said "construction is expensive. We're paying XXXX dollars per square foot and we can't afford to add a closet just for networking stuff." That, or they offer to add a 3ft by 3ft closet kind of like a broom/mop/janitor closet. With no cooling of any kind.

I guess we could've insisted, but several customers have told us that we'd lose the bid if we "made" them include an IDF closet. They simply weren't doing it. In speaking with the engineers and architects and asking why they aren't including more data closets, they said the same thing. Customers just don't want them anymore. Because "everything's on Wi-Fi nowadays" nevermind of course that the APs have to be patched somewhere .

For small/medium buildings, what we've had to do instead is to get a 12 or 18 or 24U rack from Navepoint or whatever and tell the customer that this HAS to go somewhere relatively centrally located, on a dedicated electrical circuit. It will make fan noise so whoever works near it is going to just have to deal with that. For larger buildings, we have been able to insist on an 8ft by 8ft central "data room." And then plan to put a bunch of 18U racks around the building for the bulk of the copper ports.

But as soon as that "data room" appears on the plans, EVERYONE wants to pile all of their crap in there too on the walls. Access control, burglar alarm, fire alarm, PA system, main breaker panel(s), etc. We have limited success arguing that stuff out of the space so we actually have room to work in there. Customers have usually accepted since they don't have to eat square footage on it.

"Back in the day" when I first started doing campus networking, we got IDF closets that were minimum 8ft by 8ft so we could fit at least a couple 2 post racks for switches and patching and UPS gear. But that doesn't seem to be considered anymore...

Mount network drive to raspberry pi

Hello everyone,

how can I mount a share smb folder to my raspberry pi (with remote desktop/console)?

Lets say I have the mount path media/myNas and I want to mount 192.168.2.119/Folder_X.

How would I approach that?

Thanks in advance

Need some silent switches for home

Guys looking for some silent switches for home. Cisco, Aruba are all good. I'm moving away for Unifi as I am starting to hate them.

Any switch up to 24 port is fine. Just needs to be quite. I know enterprise doesn't do quite so I'm willing to do some mods

Sharing a fibre connection to get better value for money.

I am currently with a fibre provider and get 20Mbps/2Mbps for R929. My neighbours probably have a similar package. I am considering approaching 2 of my neighbours to split a 1Gbps/100Mbps among the three of us which will only end up costing R500 each.

I would say that I am the one who knows the most about networks among my neighbours and me (if I needed to guess), so I would probably have the main router and use cat6 cables and gigabit switch to split the connection to them.

Would this be a feasible thing to do? Are there any serious issues that could arise when doing something like this?

HSRP on subinterface (Both router showing active)

Hello everyone,

https://i.imgur.com/B5mS0SP.png

I tried lot of troubleshooting and couldn't come up with solution. Both my routers are showing hsrp active for group 10.

All interface of both switches are in trunk(encapsulation is dot1q). EDGE-R1 cannot ping EDGE-R2 subinterface ip and vice-versa. But both routers can ping virtual hsrp ip. When debug on both routers i see both are sending hello packet but seems not receiving each other hellos which i suspect causing problem.

Am i missing something in configuration ? Any suggestions would be helpful .

Address Assignment or Juniper SRX210

I have a Juniper SRX210HE running 11.4R7.5 which I recently tried to configure access address-assignment on. Configuration checked out successfully but it didn’t actually give out IP addresses. I then removed that config and configured DHCP as a system service which worked.

I have the same device on another site running 12.1X46-D65.4 using access address-assignment successfully. Does anyone know if this is a firmware thing?

Connecting catalyst ap to eve ng catalyst 9800

Has anyone managed to connect a physical ap to a wireless controller node in eve ng. I’ve got an eve ng lab on google cloud with a catalyst 9800 controller, I just didn’t know if it was actually possible to connect an AP to this lab. If not I’ll go down the d-cloud route. I am just trying to create a lab to test a few things before I deploy the full solution in production. If it is possible any pointers would be awesome

How to trick smart TV into thinking my router is connected to the internet?

I have a PC setup with lamp if that helps, but I'm still learning.

I am attempting to screen mirror my phone to TV and for whatever reason this seems to be designed to not work unless there's a router setup as sort of a middle man between the phone and TV. (WiFi direct doesn't seem to be a mainstream option for now.)

I'd like to purchase a router, connect phone and TV to it, and then screen share my phone. One problem is that the TV refuses a WiFi connection if there is no internet connection present on the wifi.

Is there some way to have a router connect to a lan, so that the tv could ping the lan and accept the connect to WiFi?

current state of the catalyst 9500

Been using c6k for the last 8 years. started as the One True Core, but have migrated L3 DC core off to arista and now the c6ks mostly run the WAN (multiple 10G site to site) and what we'll call all the oddball stuff.
- Light MPLS/pseudowire (think of it as throwing really long cables between ports at different sites - I don't lean on it but it's handy from time to time for screwy stuff)
- really significant use of multicast/MVPN (5-10G/sec, maybe 300 groups)
- light NAT
- netflow
- handful of VRFs

Really, you could say I've been using the 6500s as fast-but-feature-light routers. Never broke 'em because I don't have a huge network. Haven't upgraded because, ain't broke yet / other things to do, and somehow 6800 was just never that compelling really.

Looked at c9k a year or two ago and was told "not well-baked-enough yet, run away".

Would like to use something like a 9500-48Y4C as a quasi-"drop-in-replacement" for the 6500s. (Don't have really high port counts on the 6500s, so this works.) Are these features likely to work well enough at this point, given I'm unlikely to stress-test any given feature that hard?

Can you use SWV to chain together a 32C with a 48YC or do the two switches have to be the same model? (understood that they might want to both be UADP3 or UADP2)

Can you use the ports on a 9500-32C or QC as 10G ports with the 10G-as-QSFP adapter thingies I've seen or does that not work?

Buying SFP28 Cables

I'm getting together some passive SFP28 cables for a 25Gbps project. This is all short run .5m or 1m, in the same rack. Switches are Dell and NICs are Mellanox ConnectX-5 and Intel XXV710. I've been chatting with a rep at FS.com about cables from them. He's telling me I'll need 'custom' cables with one end designated for Dell and the other for Mellanox/Intel etc. This doesn't make much sense to me. Can it be you'd need a diff cable for every NIC in the mix? The switch came with some Dell branded SFP28 cables, they work just fine with both NICs as well as some Broadcoms.

​

I'm also going to connect a Fortinet switch to the Dell switch via SFP+ (10Gbps). Totally makes sense to me to have a custom cable for that.

100G fiber optic network tap that splits to 4 ports?

I am looking to buy a 100G network tap that mirrors 1x 100G link to 4 ports (see diagram https://imgur.com/a/ly2qf91)

I'll just need a single mode 100G passive tap right? that will split/copy to 4 other ports that will go to the servers. I can't find any taps like this.

all i see are taps that copy to one link, then that one link goes to an aggregator or packet broker.

Does anyone know if what i am trying to do is even possible? are there 100G passive taps that will split to 4 ports?

​

thanks

POTS lines on cat6 next to ethernet

We need to add several POTS lines to our building and I wonder if anyone knows if there is a rule about how close to ethernet cabling they should be run. Everything will be on cat6a. Our biggest run of cat 6a for data is on basket tray right next to a bundle of low voltage wire for security, doors, etc. It would be convenient to just bundle the new cat6 with the other low voltage and be done with it. I don't think management cares, considering how messy the original job is & how little the phones will be used. But I'd also like to do it right.

Ideas?

IGP metrics in BGP for choosing the best path

I was torn between posting this to fortigate subreddit, since my issue is kind of with Fortigates, but the best path algorithm should be pretty much the same for all vendors. And fortigate subreddit crowd tends to not be as competent. :D

​

Anyways, my issue is, that I get the same route from different sources, but I need my BGP endpoint to prefer the one with the lowest metric from IGP, but for some reason, it uses some other parameter, but I don't know, which. I have implemented the "set bestpath-as-path-ignore enable", but this should not even come into play here, since the AS path length is the same to this network.

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, S Stale Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight RouteTag Path * 10.253.1.0/24 10.255.7.1 2 0 0 65501 ? <-/-> *> 10.255.8.1 3 0 0 65502 ? <-/1> 

Meaning it chose the one with Metric "3" for some reason.

Excerpt from some FortiOS handbook:

• If there is a tie, break the tie based on the following in descending order of importance: shortest AS_PATH, smallest ORIGIN number, smallest MED, EBGP over IBGP, smallest metric or cost for reaching the NEXT_HOP, BGP identifier, and lowest IP address.

​

Does anyone know what do they refer to with the "smallest ORIGIN number"? From my understanding, this could be the only one, that breaks the tie before "smallest metric or cost...". But if it is router id, it would not make sense again.

​

VRF 0 BGP routing table entry for 10.253.1.0/24 Paths: (2 available, best #2, table Default-IP-Routing-Table) Not advertised to any peer Original VRF 0 65501 10.255.7.1 from 10.255.7.1 (10.255.9.1) Origin incomplete metric 2, localpref 100, valid, external Last update: Fri Sep 11 18:51:10 2020 Original VRF 0 65502 10.255.8.1 from 10.255.8.1 (10.255.9.2) Origin incomplete metric 3, localpref 100, valid, external, best Last update: Fri Sep 11 18:51:10 2020 

​

Strange OpenDNS/Cisco Umbrella behavior

Hey all, wondering if anyone else has ran into this. Quick background: MSP for local businesses. We have about 40 networks that we manage. We like to use Cisco Umbrella for their primary DNS.

Last night, got a ticket in that one of our clients' internet was down. No down notification from our SNMP server. Strange, I see traffic flowing, SIP is working, but our remote desking software shows all machines offline. Ok, reboot the firewall to see if it solves. It doesn't. I make the trip down there.

On a local machine now, can ping external addresses, but dns lookup failing. Take a test machine, swap DNS on local interface from Cisco to Google, DNS is now responding and can load pages. Ok, set the firewall to start handing out Google DNS and rebooted. All machines are back in business.

No other clients were affected. Has anyone ever had Cisco Umbrella seemingly deny service from specific client sites?

As I was typing this out, another client called in with similar symptoms. Now I'm just trying to get their Windows server to start handing out Google DNS which is not quite as easy as a network that has the firewall manage DHCP and DNS :/

IPTables VPN Redirect Setup

So here's what's going on and I cannot get it to work although in the past I had something very much alike working fine using two iptables rules.

I am connecting to OpenVPN server from windows machine. Lets say that VPN server is: 10.0.8.1 and the windows machine VPN address is 10.0.8.5.

There's another machine I'm trying to forward VPN traffic too on specific port 7575 with WAN IP 216.178.188.258 and end up using 8001 on openvpn connected client (10.0.8.5:8001)

So far I have setup masquerade so tun0 and eth0 can communicate well

my iptable rules would be:

iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 7575 -j DNAT --to-destination 10.0.0.5:8001

This does not work and i get a lot of [TCP Retransmissions] via TShark

Basically I want to forward a vpn connected clients port 8001 to an external WAN ip "216.178..." using different port 7575.

It seems that it can forward to it, but i cannot get any packets in return. Please help!!

IPIP for iBGP Next-hop Self

I have an OSPF network where my BGP routers have non-iBGP routers between them. Because of physical path diversity, I will be using IPIP tunnels to "backhaul" traffic between the BGP routers (for best exit.)

With the next-hop being the loopback address, I fear the routers may try sending traffic to the middle ospf routers instead of the tunnel. Is there a way to modify the forwarding table to prevent sending traffic whose next-hop is the other BGP router to the OSPF routers whose routing tables are not complete?

I would really like to use the loopback as next-hop in the routing table; so while using the tunnel's endpoint as the next-hop address would work, it's my "nothing else works, so I have to" backup plan.

Issue with teams voice traffic

I am hoping someone has had this issue and has been able to resolve it. When an end user is on VPN and initiates a teams call to someone on the corporate LAN the call connects you can hear audio for 5 to 10 seconds then the call will terminate. If the call is from corporate LAN to VPN user there is no issues experienced. Right now we have forced vpn setup where all traffic goes to the corporate network before routing anywhere else. Microsoft suggest setting up a split tunnel but at this time upper management does not want any traffic not to come to corporate first. I ran a packet capture and what I can see is when the issue happens I can see the corporate IP sending traffic to the VPN IP but no return traffic. This is why I am assuming the call gets dropped but I don't understand as to why since the call from corporate to VPN all traffic flows without any issues.

Hard Wood vs Carpet

Is it better to have a network rack in hardwood or carpet?

Help with bandwidth on WAN failover

Hello,

We are currently using a Cisco Meraki with Comcast internet. The only available alternative in the area is Cebtury Link DSL, which we use as a backup. The site I’m working on, has Nest cameras which use a lot of bandwidth, since they are constantly uploading to the cloud. Everything works fine when on the Comcast internet, but once it fails over, the DSL doesn’t have enough bandwidth to keep up. Any ideas on the best solution here? How can I prevent the Nest cameras from failing over when the backup internet kicks on? The modem is an Arris SB8200. I thought about putting the best cameras on a separate network, but even then I’m trying to figure out the best way to do this, since it seems like I can’t put any rules in meraki for the failover.

Thanks for you help!

IPSEC/UDP fragmentation - fragmenting an existing fragment on the path?

Hi,

Was wondering if someone here is so deep into the theory bits that they could elaborate on practical consequences of fragmenting a payload more than once on the path of the packet. I have a case where I use double tunneling (VPN tunnel inside a VPN tunnel) and was wondering if fragmenting an already existing fragment means it's essentially impossible for the packet to get through or is it just increasingly unlikely?

I had a practical issue that I will probably try to solve by decreasing the size of the packet, but was wondering how this should even work in theory? My own guess would be that the packet might pass, but it's more likely for timers etc to run out before reassembly happens properly, especially with different sets of timers running on different hosts.

NAT Reflection Cisco IOS

Im having trouble where client wants to access host that is in same subnet as him but wants to do it with outside ip(that host is port forwarded)

As i know nat hairpinning is the solution for that. If you could show me config example..

Also for now i want save nvi as last resort.

Cisco IOS 16.12.03 Gibraltar

Cisco ISR4321

Need help to chose basic Network Monitoring Solutions

Hello fellas,

i try to find some open source software for basic network monitoring and i am not successfull so far.

I need something like ipscan but to works all the time and informe me if some host not active for some period of time.

I find solutions like zabbix or cacti or even poweradmin but its to complex i think about something simplier like freeping. I need to have list of all devices in real time and to know when they alive ...

Thanks

Network discovery software

Hi,

I started working at a school as an IT system admin. Our network is physically divided in to network 1 and network 2. All the wiring goes to server room where we have all our servers, switches and patch panels. The problem is that i dont know what switches are network 1 and what switches are network 2 because nothing is labelled. And i was thinking is there is a software that can help me discover that. What i need is a software that i can run on a PC on network 1 and it will shove me all the devices and their serial numbers in that network and base of that information i can locate what i need. And then repeat the process on a network 2. Does anyone know what software can do that?

Core router migration

Hi all,

We're in the process of replacing our core L3 switches with new ones and the only thing missing is the routing part, everything else has been moved to the new core.

I'm looking for some advice on moving the routing with as little downtime as possible, so I'll list the steps we've come up with hoping you'll critique it and come with improvements.

The plan currently is to pull the network cables on the old core and activate config with routing configured on the new core for as low downtime as possible.

​

A little about the network:

The old core is two HP 5406zl using VRRP

The new core is a pair of HPE FF5940 setup in IRF

Both are connected to our Checkpoint firewall cluster and the rest of the network.

Routing is static routing (don't kill me, it was setup before my time) with transit networks between the cores and the checkpoints, everything behind the cores is L2 with VLANs.

​

Is there someway to do the migration with zero downtime? I don't think this is possible with static routing but I might be mistaken?

[SMTP] [STARTTLS ON PORT 25]

I need help on this issue which on asked StackOverflow but hasn't been answered. it would be good if anyone can help with solving it or recommend a good subreddit to post this.

Need help urgent

Which of the following statements is NOT true about the Control Plane in SDN Software-Defined Networking) systems?

Select one: a. In SDN, network behavior can be controlled using higher-order programs b. In SDN, the software control of the network can evolve independently of the hardware c. In SDN, the Control Plane is implemented in a centralized way d. In SDN,the Control Plan forwards traffic such as layer2 switching. e. In SDN, the Control Plane is decoupled with the Data Plane

Tracing wires

Is there a way to easily trace or figure out how the house is wired for cat5e? I've got few outlets where they had phone jacks before but the cabling used was cat5e. There were two wires at each outlet. I reterminated the wires with the cat5e jacks. But I've found that not all jacks are connected to each other. So it looks like they don't all connect somehow. But I figure they must have terminated them somewhere. I just want to be able to find where they all terminate so I can connect them with a switch, etc. I do a cheap wire tracer but it's not that great as it doesn't pick up the signal behind drywall easily. It can certainly tell me which tow ports are connected but tracing part is bad. So I'm trying to understand how should I go about identifying these wires. Do I get an electrician? Or low voltage contractor to trace them? How much should I be looking to pay for such job? It's also odd that if it was used as telephone jack, I would have thought all of these jacks must be on same wiring.

Why will DHCP break if you have the server's switch port tagged?

So, I know this doesn't work because it always happens, but why?

Example:

I have a default VLAN on a switch and its DHCP server is on, for example, port 3 giving 192 addresses.
Port 1 is a trunking port to firewall with VLAN 1 and 10 tagged.
I tag all 24 ports on the switch with 10, untagPVIDonly.
I plug a phone into the switch and manually assign VLAN 10.
Phone is set to VLAN 10 but gets the default VLAN's DHCP of 192.
I take VLAN 10 off of the DHCP servers switchport 3, making it an access port on the native VLAN, and everything works. The phone now get's it's 172 address from the firewall.
Why does this happen? The most I can work out is that the broadcast for DHCP on port 3 is somehow bleeding into VLAN 10.

Catalyst 9200 pricing?

Hi All. Apologies if this belongs in a weekly pricing thread or somewhere else. I've inherited a closet with an ancient 3750 stack that I need to replace. It looks like the 9200 series will do everything I need (basic switching, PoE, EIGRP).

I always dread buying Cisco because we do it so rarely and in such small qtys (I'm looking for 4 switches) that I feel like the resellers quote us higher pricing because we have no frame of reference.

Looking at Google, I see CDW pricing the C9200-48P-E around $4500 but then I see the exact same SKU on router-switch.com for $2200. That's a huge difference and I don't understand why it exists.

Can anyone help me understand what a fair market price for these switches would be? Also, aside from the switch itself, do I have to purchase any kind of additional licensing? If so, what?

Please recommend the easiet Site to site VPN(software based) to setup?

I work in a tiny startup with half a dozen employees and none of us are very skilled on the networking side of things.

We’re trying to get a site to site software VPN setup (between AWS and Google Cloud) that is dead simple to configure. Paid is fine (and preferred) since we’d have access to support services.

I’m thinking something as easy as install the software on both VPN servers, plug in the public IP addresses into some GUI on each side, add subnets, add users, check some boxes and were up and running. We’ve looked into the managed VPN solutions the cloud providers offer which would be ideal, but we cannot afford the costs right now.

We tried testing out OpenVPN access server but their documentation isn’t very thorough (seems to be a lot they assume we would already know!) so we couldn’t get things to work.

Is there anything out there that’s better and easier to setup?

Blogpost Friday!

It's Read-only Friday! It is time to put your feet up, pour a nice dram and look through some of our member's new and shiny blog posts.

Feel free to submit your blog post and as well a nice description to this thread.

Note: This post is created at 00:00 UTC. It may not be Friday where you are in the world, no need to comment on it.

Was there a point in time where networking just "clicked" for you? Where everything you learned finally meshed together and just made sense? If so, after how long?

I just recently started studying for my CCNA and I'm overwhelmed with the amount of information.

STP Activity When the Network Remains Stable, what is the purpose of changing the bid?

Okay, so I know BID plays apart in helping switches to designate a root switch ect. My question is, after everything is established and you have your root ports, designated ports, non root switches and root switch, why does (look at step 2.) the BID receive get changed into THAT senders BID before being sent off? Is it to keep switches from trying to establish "dominance" again orrrr?

Step 1. The root creates and sends a Hello BPDU, with a root cost of 0, out all its working interfaces (those in a forwarding state).

Step 2 .The nonroot switches receive the Hello on their root ports. After changing the Hello to list their own BID as the sender’s BID and listing that switch’s root cost, the switch forwards the Hello out all designated ports.

Step 3. Steps 1 and 2 repeat until something changes.

Star tech media converters

Has anyone had an issue with this companies media converters? I have 2 sc fiber connected media converters that support up to a gig but when plugged in am only getting 15mb down and barely 1mb up. Before that I was using much older converters that only supported 100mb from a different company and my speeds were much higher and normal. Anyone have any abnormal experiences with these and or fixes? Thanks

Question with cisco switches

Just got my first netmiko script working. Very basic, just gives me the interface status for one switch

from netmiko import ConnectHandler cat3750x = { "device_type" : "cisco_ios", "ip": "x.x.x.x" "username" : "user" "password" : "password" "secret" : "password" } net_connect = ConnectHandler(**cat3750x) net_connect.enable() output = net_connect.send_command("show interface status") print (output) 

So this works good for one switch. But I have about 70 switches i need to hit. I already have a file called "hosts.txt" with a list of all the IPs I want to hit. What can I add to this so that the script looks at a file called "hosts.txt" and hits every switch on that list with the commands?

Can I communicate to a docsis transponder without a cmts?

Hi everyone. I have a few transponders I wanted to test for functionality. They have a local ethernet port and a coax rf port. I can connect locally and everything works there but I wanted to make sure it could communicate through the rf port as that is its main form of communication. It uses standard docsis protocols but I want to avoid buying a cmts if possible. Is there a way to mimic a cmts to be able to communicate with the rf port? Thanks in advance.

Netmiko Cisco Question

Just got my first netmiko script working. Very basic, just gives me the interface status for one switch

from netmiko import ConnectHandler cat3750x = { "device_type" : "cisco_ios", "ip": "x.x.x.x" "username" : "user" "password" : "password" "secret" : "password" } net_connect = ConnectHandler(**cat3750x) net_connect.enable() output = net_connect.send_command("show interface status") print (output) 

So this works good for one switch. But I have about 70 switches i need to hit. I already have a file called "hosts.txt" with a list of all the IPs I want to hit. What can I add to this so that the script looks at a file called "hosts.txt" and hits every switch on that list with the commands?

Is there any reason to lock down a LantoLan Any rule or can you?

Hi, recently we setup a second office and are using a Sophos RED60 to connect to our main site running a sophos xg450. Its a super basic setup since the RED device acts as a VPN passthrough and all settings are on Sophos. Were still getting equipment setup but I noticed VoIP calls didnt seem to work when dialing internal and I also cannot ping that subnet.

A policy test revealed packets dropped due to no rule. I created a Lan to Lan Any Any rule and everything now works. I went through some documentation and it seems like thats what sophos recommends as well.

My question to you experts is, should I put anything else in place to help lock that down?? Ive done some research but I cant find a discussion on this.

My fear is its a security risk somehow but only because I know "any to any" rules are typically terrible but this is lan to lan so im not sure.

We have Juniper switches with a few VLANs so you would think all internal traffic is handled and dropped by that as needed. The firewall is only needed because packets to my RED device must pass through the sophos. Im guessing it needs that LAN rule to work in that direction.

Sorry for the long winded post, any insight is greatly appreciated!!

TLS interception while keeping ciphers ... (ja3 fingerprint) the same

Anyone knows an appliance for TLS interception which does not change ciphers and other stuff from the original clients or at least allows to customize them so that the connection still looks like coming from the normal client and not some middlebox ?

Background:

https://engineering.salesforce.com/tls-fingerprinting-with-ja3-and-ja3s-247362855967

https://www.ntop.org/ndpi/effective-tls-fingerprinting-beyond-ja3/

https://i.blackhat.com/USA-19/Wednesday/us-19-Valenta-Monsters-In-The-Middleboxes-Building-Tools-For-Detecting-HTTPS-Interception.pdf

Anyone dumped Cisco wifi for another vendor?

We are looking at a major wifi upgrade project at several locations. Currently, we are using the older Cisco WLCs and 3602/3702/2802 APs. We've been relatively happy with this Cisco gear, and I'm not opposed to Cisco, but, on the other hand, I'm not married to Cisco, either. I realize that if ever we were going to jump ship to another vendor, the time is now.

Anyone else leave Cisco behind for wifi? Who'd you go with? Are you happy with the results? Any caveats or gotcha's that you didn't expect?

Programmable and/or DPDK-P4 NICs - What to buy to experiment with?

So for the next R&D project, I'd like to toy around with programmable NICs - either FPGA-based or standard NICs I can do some interesting things with for DPDK, P4, etc. I have a lot more research to do here, but is there an easy answer in terms of picking a "well supported" NIC or NICs to do interesting things with in this arena for a small lab? No more than 10Gb

Aruba Blacklisting, Why a specific device?

Hello,

Does anyone know of a way to find out why a device keeps blacklisting itself on an Aruba controller?

​

TYIA

Migrating from OSPF to EIGRP across infrastructure

Yes, I know it's typically EIGRP to OSPF migration. But I need to go the other way.

However; my company has been absorbed by a much larger one that uses EIGRP.

There is zero chance they will convert their 400 node (stable) EIGRP network to OSPF so lets drop that as a solution please. They are Cisco 100% with almost zero chance of bringing in anything non-cisco that routes. :)

My OSPF setup is small. Area 0 with 6 ABR's. I have 6 Dmvpn routers, 2 pair of nexus 6k switches one Nex 9000 and 6 pairs of 5508-X's running OSPF.

Half of my ABR's are Cisco 881 dmvpn routers for SoHO use. The other 3 are offices with 100 to 300 people in them

Can you guys point me to any docs for OSPF to EIGRP migration/tips.

DDG (duck duck go) search gives me TONS on OSPF to EIGRP. Zero on the reverse.

Thanks

Random SFP negotiate question

Can't find a google solution to the actual issue we're having:

We have remote office space in a very large building (not ours), where the ISP demarks about 1100 feet from our network closet. There are no network hops between the demark and our equipment. We ran single mode fiber between the demark and our office space, but the ISP terminates in copper (its a small speed circuit). We are using fiber/copper converters on both ends. It has been working for about 6 months, until last week it suddenly stopped. Upon review, when it was setup, the only SFPs available were SM 10gb SFP+ with 10km distances. When I touched the demark SFP, it was so hot I couldn't hang on to it.
So my colleagues and I are debating....will the 10gb SFP+ "negotiate" to what it needs to, or do we need less power (2km distance)? All we have on hand are the 10GBSFP+ modules, we have no 1 gb SFPs on hand. Some people want to go ahead and use the 10gb modules, thinking the 2km vs 10km power difference will keep it from overheating. I'm not disagreeing, but I am skeptical that the little fiber/copper converter boxes will do the right thing when presented with a 10gb SFP+, and I don't want to burn up anything.

So, Reddit, what say you? In this situation, what is the potential fallout from using the 10gb modules to go from Circuit-copper-converter-SFP-SM fiber-SFP-converter-copper-switch?

Aruba Central Outage

Anyone else have any issue with Central today?

Use Dell switches for inter site routing? I'm 99% sure I can do this but having a issue wrapping my brain around it

I'll try to make this as short as possible. Main building with all network resources and three branch locations. Two of the branches were connected with T1 lines and a outside company at the time put in Cisco 1921 routers.

Over the years we have changed out the T1 lines for 50/50 private Ethernet lines (logically a really long patch cable) and the router configs were simply switched from using the serial port to E1. Nothing else was changed. These routers are now EOL. Looking at Cisco's offerings it seems kinda expensive for this simple routing job which other then the standard routing stuff is a QoS rule for VoIP.

The main building has at the core a Dell N3048 and each branch has a Dell N2048. Is there any reason I can't just get rid of all the Cisco 1921 routers and have the Dell switches do the routing? For some reason in my head it's ingrained that the switches are switches and routers are routers and that's it. We have 4 VLAN's defined and the switches are doing the inter vlan routing currently. I also did some searching and I could not find any examples of people doing this. The only thing I have to worry about is QoS for our IP phones but thats already enabled on the Dell's.

This should be easy right?

Cisco ISE 2.7patch2

General question here. I have been an ise admin for about 2 years. We transitioned to 2.7 recently and I'm noticing with this ISE that we need to reboot our appliance every other month. When some users aren't getting DACLs and some aren't able to get authenticated. A reboot seems to fix it. Very odd. Even cisco TAC tells me to reboot if we have been troubleshooting over a week and there isn't an easy explanation.
Anyone else seeing this?

The matter of website has two A record

What happened if website has two A record?

Starting a junior network admin job on Tuesday! Any advice on how to start off great?

This will be a huge deal to me - i've been studying for the CCNA, but I'm going to focus a ton on it this weekend. Is there anything else I could do to prepare for my job? Something to look out for on the job?

Server visible by only some machines in the same network. I need some help.

Hello, I hope this is the right place for this question. I'm not a network administrator, just a user, but the network in question is definitely an enterprise one. I know your first answer would be "let your IT team figure it out", but what I'm trying to do here is to work around the idiocy of said IT team, so I don't want to draw too much of their attention on this (no, I have no risk of getting fired for it even if IT finds out and is not happy). This is the network situation:

$wired - wired network (whitelist access to it)

$wifi1 - wifi, wpa2-eap protected

$wifi2 - wifi, wpa2-eap protected

$wifi1 and $wifi2 have two different SSIDs, but I'm relatively confident the user is getting authenticated by the same server (i.e. the network is basically the same).

I have a server, let's call it $server (a Synology NAS), that is connected to $wifi2 (through a raspberry pi acting as wireless network card, as $server can't have one installed, and IT doesn't want to whitelist it for $wired). Here's my problem:

• $server has internet access (so the connection is working and is configured properly)
• $server is reachable by all machines connected to $wired
• out of 6 machines that I've tried, connected to both $wifi1 and $wifi2, only one can reach $server (the one that can reach it is connected to $wifi1)

This is driving me nuts. I don't understand how one single machine connected to the wifi can reach the server, but not all the others. Either all should be able to reach it, or none, right? Can anyone suggest how to troubleshoot this, given the "user only" access that I have to the network?

Flexconnect ISSUE WLC3540 exit to internet

Hi all,

I'm implementing flexconnect for a customer and I would kindly need your support, as we have a problem with internet reachability from clients. I'd like to point out that this is not a branch office but it's their only office, so from the beginning it's not a best practice to implement flexconnect, in fact at first we opted to configure the AP in local mode (the standard one) and everything work

The architecture currently consists of 2 distribution cores (9500) that are directly connected to perimeter switch which in turn is connected the Huawei cpe (of service provider) . The only routing is a default route versus CPE.

WLC 3540 (in SSO mode) are connected to 2 access switches because the customer is not yet in possession of the transceivers to connect them to the CORE (even this thing is not a best practice).

Today doing some tests and enabling the flexconnect as Cisco guide and with Central DHCP (so we don't have to create the pools on the access switches), we had problems with the traffic to the internet; first of all the ip is released correctly but, from a traceroute we saw that the packets get stuck to the CORE, which it didn't do in the local mode (in fact before it was released correctly on the internet). As for the internal traffic, even between different vlan, the flexconnect works correctly not passing through the WLC.

is it possible that the NAT-PAT option of the DHCP central does a weird NAT and my client presents itself with another ip that is then blocked by the perimeter switch with an ACL? (customer doesn't have any Firewall yet). The Flexconnect configuration is done as standard: I configured the port of the switch where the ap is connected with the native management vlan and the other vlan in allowed; I did the vlan mapping on the ap and enabled the flexconnect local switching under the WLAN.

Someone has some suggestions.

Thanks to everyone for the support

PanOS 10.0 multiple firewall clustering

According to Palo Alto documentation, PanOS 10.0 introduced multiple firewall clustrering. I'm thinking about two A-A or A-S HA pairs in different DC's, clustered together to do DC - DC stateful failover on stretched L2 segments where these FW's are L3 gateways. Has anyone tried to set up this feature, or maybe even run it in production? What are Your thoughts regarding stability and production readiness of this?

Creating 2 seperate networks with a firewall?

I have very little experience with networking, so I don't know how to set this up. I haven't found any instructions either. I am trying to set up 2 networks, each with their own wifi and ethernet devices, on one firewall and modem. One "secure" and one "open" network that don't talk to each other. For hardware, I currently have a Netgear fvs124g firewall, 2 random wifi routers, a modem, and an ethernet switch. How would I go about configuring the firewall?

This is what I'm trying to do: https://imgur.com/a/tynGNZZ

Noob Question, Do Cat6 “pass through” connectors require those little load bars?

I know there are two types of crimp connectors, pass through ones & regular ones.

From what I know, the regular “non pass through” Cat6 connector require the wires to be put through a little load bar prior to being inserted into the connector.

Do the “pass through” style Cat6 connectors require that same little load bar to be used? Or can you just simply insert the wires into the connect like you would a Cat5 cable?

Can’t seem to find any info on this online. Would love to hear from you guys that have experience with this.

Thanks in advance!

radius w/ aruba not working mschapv2

Hey friends,

​

I am running into an issue on an Aruba 2930F while trying to configure it to allow authentication via windows NPS. If I configure it to use radius, I can get it working but I have to use PAP which I am trying to avoid. When I do PEAP-MSChapv2 however, the NPS server sends back an access challenge and then the switch just fails the connection.

On the NPS side of things, the one thing I dont have is a Vendor attribute but I, perhaps erroneously, operating on the idea that since it works with straight radius+pap, thats not where the problem is.

​

Switch configuration

aaa server-group radius "NPS" host [RADIUS_SERVER_IP] aaa authorization user-role enable aaa authentication ssh login peap-mschapv2 server-group "NPS" local 

​

radius debug from the switch

0019:10:17:43.41 LOGA mSshAlrm:user_login_lookup: name='REDACTED' addr=10.212.134.9 priv=noauth status=SUCCESS 0019:10:17:43.41 RAD mRadiusCtrl:Received RADIUS MSG: DATA, session: 81. 0019:10:17:43.41 RAD mRadiusCtrl:Received RADIUS MSG: DATA, session: 81. 0019:10:17:43.41 RAD mRadiusCtrl:ACCESS REQUEST id: 95 to [RADIUS_SERVER_IP] session: 81, access method: SSH, User-Name: REDACTED, Calling-Station-Id: 10.212.134.9, NAS-IP-Address: 192.168.100.26. 0019:10:17:43.52 RAD tRadiusR:ACCESS CHALLENGE id: 95 from [RADIUS_SERVER_IP] received. 0019:10:17:43.52 SSL tRadiusR:1704096 0019:10:17:43.52 SSL tRadiusR: 0019:10:17:43.52 RAD tRadiusR:ACCESS REQUEST id: 96 to [RADIUS_SERVER_IP] session: 81, access method: SSH, User-Name: REDACTED, Calling-Station-Id: 10.212.134.9, NAS-IP-Address: 192.168.100.26. 0019:10:17:43.55 RAD tRadiusR:ACCESS CHALLENGE id: 96 from 10.0.100.240 received. 0019:10:17:43.55 RAD tRadiusR:ACCESS REQUEST id: 97 to [RADIUS_SERVER_IP] session: 81, access method: SSH, User-Name: REDACTED, Calling-Station-Id: 10.212.134.9, NAS-IP-Address: 192.168.1.5. 0019:10:17:43.57 RAD tRadiusR:ACCESS CHALLENGE id: 97 from [RADIUS_SERVER_IP] received. 0019:10:17:43.57 SSL tRadiusR:0 0019:10:17:43.57 SSL tRadiusR: 0019:10:17:43.57 SSL tRadiusR:0 0019:10:17:43.57 SSL tRadiusR: 0019:10:17:43.57 SSL tRadiusR:handleClientHandshakeMessages() returns status = 0019:10:17:43.57 SSL tRadiusR:-7606 0019:10:17:43.57 SSL tRadiusR: 0019:10:17:43.57 LOGA tRadiusR:user_login_lookup: name='REDACTED' addr=10.212.134.9 priv=none status=FAILURE 0019:10:17:43.57 RAD tRadiusR:Removing RADIUS REQUEST id: 97 from queue. 0019:10:17:43.57 SSL tRadiusR:SSL_closeConnection() from AppType: 0019:10:17:43.57 SSL tRadiusR:0 

thanks in advance

Can you shutdown and enable VLANs while within the configuration of other VLANs?

SW2(config)# no shutdown vlan 10

SW2(config)# shutdown vlan 20

SW2(config)# vlan 30 <------------- This is where I'm confused.

SW2(config-vlan)# no shutdown l

SW2(config-vlan)# vlan 40 l

SW2(config-vlan)# shutdown V

When I enter in sw2(config)# vlan30, I go into the configuration mode of that vlan. So isn't every command I enter after that point supposed to be associated with that specific vlan? How is it that I can access other vlans from the configuration interface of another vlan?

Carrier equipment in outdoor shelf - LWL LC Connectors & humidity

Hi there,

i need to install some metro Ethernet FTTC backhaul equipment in some (insulated but not AC'd) outdoor shelves.

I'm already fin withe the Devices itself (e.G. Cisco ASr920 or Juniper ACX) that are able to operate in env Ranges between -40°C and +70°C.

My only concern is the LC connection between fiber and SFP. The installation will be in northern Germany where we have 4 months of hot and dry summers and 8 months of wet and foggy Fall/Winter/Spring/whatever.

As we all know the fiber material itself dons't like humidity. Is this a problem for the Connection between SFP Optic and the tip of the LC connector? (sry for not finding the correct words)

I did some research (googled) for LC Connectors that are e.g. IP55 rated, but only found LC/LC Couplers within an insulated container, noting regarding the Connection between SFP and fiber itself.

Has anybody knowledge in this point and can share his experiences?

//Andreas

VLAN Switch noob question

Are there two different type of switch a VLAN switch or a LAN switch or the VLAN/LAN its all one switch. Thanks

Question: Why am I able to access LAN website from WAN?

Sorry if my terminology is not on point with this question, I am pretty new with playing/learning about networking. Here is my situation...

Hugesnet service without static ipv4 address, there is a LAN server with a web app used within the LAN with no problem. There was interest in being able to access the web app from outside the LAN (want to be able to access the web app from home). After playing around with port forwarding and learning more about how the internet works I came to the conclusion that without the ISP giving me a static ipv4 address this route would not be practical. With nothing left to lose I started playing around with ipv6 (no idea what I was trying to do, just messing around). From outside the LAN I entered the ipv6 address for the LAN server into the browser and I was able to access the web app from outside the LAN. This seems to work for a while (week or two) then stops, I believe it has something to do with DNS, after I reboot the modem it starts working again. Any idea why with ipv6 I am able to access the LAN server over WAN? Thanks for any input!!!

Using a network bridge to connect to a Pi Server

I work for a company that produces a Raspberry Pi (embedded) product. The way that you interact with it is through WiFi (the Pi is set to master mode). Normally, you can SSH into the Pi and go to the default gateway through a browser on the PC connected to it, and it will serve you a Web Based IDE that we use for the product. Essentially it's configured as an Access Point web-server.

I'm trying to setup a network bridge such that we could access the Pi like normal, but allow the Pi to use the other network source (Ethernet in my test case) to access the internet.

I changed the IPV4 property of the network bridge and I set the information to match the IPV4 information on the Ethernet connection (default gateway, iv4 address, subnet mask, and DNS address). This allowed me to still access the internet on the bridge machine, but the Pi can't even ping google. This also stopped me from being able to access the Pi's server and SSH.

I also tried setting the IPV4 settings to match the Pi "server" by taking the information from ipconfig, but that just makes everything stop working (as I'd expect).

Then I tried using the advanced settings to add two DNS sources and two IPV4 addresses (with their proper subnets and everything). This also ends up breaking everything, even when I try different priorities.

Am I trying to do something that is impossible or am I just doing it wrong? Am I even asking the right questions?

Note: I am using the Windows machine but if necessary I can switch to the Linux machine (I am more familiar with Linux anyway).

Thanks in Advance

Cisco Commands that I wish I learned earlier ...

I started as a Network Admin back in 2002. Along the way, I've picked up a few commands that were not part of CCNA training... but have been pretty useful. I'm sure there are others. Please share if you have something that is not part of a normal CCNA /CCNP training... but makes your life easier anyway.

• Config terminal revert timer 20 - Make changes to to the config, but revert back in 20 minutes if I do not confirm. I use this so I don't lock myself out of a switch form time to time....
• show ip device tracker or show device-tracker - I will use this on an access switch to find the IP address of the device that is connected to a port.
• test cable-diagnostics tdr interface .... - Use to do simple cable diagnostics i.e. length of cable pairs. Are the open or shorted.
• alias exec hardening version 8.2 - 09SEP2020 - I will use this as a way to making notes in the running config. This would tell me that I applied a hardening script to the device, version 8.2, that was created on 09SEP2020. This gives us an idea of what the enable password might be on a switch that has been offline for a while. I'll also have Solarwinds flag switches that don't have the latest verision in the alias exec note...
• define interface-range

define interface-range trunking gig 1/1/1

define interface-range users gig 1/0/1 - 24

I will use the define interface-range in the active switch config so that I can make scripts for trunking ports and users ports and apply it to different switch models. Some models are 24 port. Some are 48. Some have trunking on TenGig ports. Some have it on Gig ports.

When apply a script...

config t

interface range macro trunking

(all the commands I want to apply to trunking ports)

interface range macro users

(all the commands I want to apply to user ports)

end

Dialer interface flapping

Just wondering if a DSL link which is experiencing high utilization could cause the dialer interface to flap. This dialer is associated with a physical ATM interface which is stable. So I'm thinking the maxed out link could be causing the dialer to flap, would anyone know?

Question regarding PBR and multiple routers

I have a home lab environment with an Edgerouter X as the edge router/firewall and a 1Gbps connection from my ISP. The ERX is not capable of handling the connection at full speed so I am trying to come up with a solution that fits me requirements and will allow me to get more usage of that 1Gbps. Currently I haven't been able to pull more than 600ish Mbps.

My set up now is the ERX at the edge with a few vlans for guest, personal, IOT and such. The ERX also has hwnat offload enabled.

My goal is to keep the ERX at the front, with a vlan configured as a flat network for guest devices and wife approval continuous Wifi. This VLAN would handle NAT, and basic FW rules. Then I would like to have a second network that is connected to a VM firewall(*sense or Sopohs) hosted on a node in my proxmox cluster. This VM will have direct access to the NIC.

My plan was to enable some sort of PBR(which I have never used) to pass the public IP to the VM firewall except for when traffic comes from guest network. Would this work and help at all? Or is there a better solution?

My full network is 1 ERX as main router, a second ERX as a managed switch, a Edgeswtich 8 150 as managed core switch(has routing capability, just not in use right now) 4 proxmox nodes, an AP, a rpi for dns, and then user devices.

Cacti template for Cisco WLC

Hi there,

I'm currently setting up Cacti to monitor our office network. Got everything working except the WLC monitoring which still gives me a slight headache.

I started to with this template: https://forums.cacti.net/viewtopic.php?t=43852

I fixed what was not working except the number of clients associated with each AP.

Has anyone a working template for that and is willing to share?

What's the difference between a NFV orchestrator and a SDN controller ?

Aren't they the same?

Cheap switch for 15GB/s NAS going to 33 Computers

In my office I have 33 rented renderfarm servers, with 23 servers in room A and 10 severs in room B, each running windows on an SSD and 1GbE networking. Every single computers pulls data and pushes lots of data into one single NAS drive, often at the same time, for many hours a day.

The NAS is a 15GB/s NVME raid array running windows sever with dual 10GbE (Mellanox CX-3), but is currently connected with only one single SFP+ link into a Mikortik CRS328-24P-4S+RM(24x GBe + 4x SFP+). This mikrotik is then used to link into the 23 servers in Room A, with the last GbE port going into a unmanaged netgear 24-port GbE switch in ROOM B.

I'm having performance issues because im using the single gigabit link between Room A and Room B, from the managed mikrotik into the unmanaged netgear switch. I am just using windows file sharing(should be on SMB3.0, but I have not checked.)

Can I just get a second switch that has with 10GbE, and connect that into the mikrotik? Is there any additional setup steps that I would have to take? What if I wanted to connect two of the 10GbE ports from switch to switch? I'm trying to avoid setting up LACP because I have read that it does not actually aggregate the throughput of the network, instead SMB3.0 supposedly supports multichannel mode naively, and it seems to work if I plug in both connections from the 10GbE nic into the switch, but I don't know how it works from switch to switch. I don't have a very good grasp on this.

1) Does anyone have any quiet 48 port w/ SFP+ switch recommendations for under $1000? I am looking at netgear or ubiquiti. The nice mikrotik 48 port switch seems to run RouterOS only, which is probably a pain to setup. I am just looking for a simple layer 2 switch I think. I guess I could also get two 24 port switches, but the 48 port would be more flexible.

2) At some point, 33-48+ computers all pulling/pushing data from that single 10GbE connection to the NAS server is going to be the bottleneck, and SMB3.0 seems to just aggregate the amount of bandwidth i have. So, I can just use two SFP+ 10GbE links from the NAS into the Mikrotik. Is this wrong, and do I actually need to setup LACP or something else?

3) Should I look into getting a better router to route this many computers or am I okay? Internet speed is not something I am worried about for this setup. I have a D-Link DIR-882 running DD-WRT and it seems to be doing fine now. Is there any point getting a professional grade router at this point if I am on a budget? I won't have the servers forever, so I don't think I don't want to spend too much money on something that wont be useful in a month or two, but it would be great to be rid of these current bottlenecks.

Mac Address Lookup Pointless?

Short and sweet. Relatively new CCNA and it is bugging the crap out of me that there does not appear to be any detailed information as to why some mac-addresses do not exist on oui-ieee.org. I have seen some talk of there being an unmanaged range of mac-addresses that devices can self generate for certain purposes but

1. Does this not defeat the point in having a unique identifier if it can be spoofed?

2. Where is this information listed? How do I determine which is and which isn't a spoofed mac-address and is there anyway to trace a vendor from these pointless addresses or should I just ignore them?

I ask as I have port security violations constantly being flagged and when I go to trace the device, it turns out it does not exist.

Very basic vlan question

I've always used flat networks, not great I know, but I'm going to be starting to segment the network with vlans

I'm doing lots of reading and will soon have a test switch to play with, I have a super basic question that I have not been able to find an answer for, I assume because it's so basic it shouldn't be asked!

If I have 5 vlans on my network and only have 1 tag on a particular port, would I need to specify the tag in the network card driver properties on a Windows PC or would it not be required as there's only 1 tag on the port?

SecureCRT license question

Hello fellow geeks

I have some question about SecureCRT licensing

Can I use the same license on two computers?

Let's say my physical computer and my virtual desktop environment?

Or do I need to purchase two separate licenses?

Dual stack lite / carrier grade NAT with IPv4

I am trying to remote access my home server and can reach it.

Is it possible that I have DS-lite even though my WAN Adresse is an IPv4.

Is there a way to test it?

Software to test users connection quality - are there any?

Hello :)

We're massively deploying users on remote via Internet and faced usual problem with links quality vs our systems/network quality. We need some tool/software that can be installed centrally in our datacenters and have a client part that can be started with simple command or a button push and provide a simple test - bandwidth, RTT/jitter, packet loss from client to central part.

Don't you know what we can use?

Thanks!

Interent speed capped by firewall

hey guys, i have been using my work internet for a few weeks, the speeds were so good i think the IT department forgot to activate the firewall since our company uses Fortinet security, right now the firewall is up and the speed is capped to very low speeds..is there a way to bypass that block??

Beginner subnetting

Hi r/networking! Im currently doing a beginner class on ict networking and am currently struggling with subnetting. I think it'd be incredibly helpful if you guys could help me with an example.

I need to subnet the following into 3 equal sized subnetworks: Ip: 192.168.175.0 Subnetmask: 255.255.255.0

If you could explain how you get the answer that'd be incredible. Thanks in advance for helping a networking newbie!

Network refresh

Good evening, I currently work for a school district network department. I have been involved in network refreshes with other jobs for example city,county networks, even an Amazon warehouse.
The refreshes were Cisco 3750s/3850s & 4500s to Cisco 9500 and 9300, stacks ect.

The current school district has 3750/3850s and 4500s. I want to start the process of stating a network refresh in a phased deployment for the next 2-3 years with smartnet as budget permits.

The main concern for the current IT department is the Cisco licensing costs along with the devices. It’s about 24 sites and about 300 devices. They prefer refreshing to something cheaper like dell switches at the access and distribution layer.

What are you guys thoughts, I have a ccna route switch and I’m not worried about working with diff brands, networking is networking, my concern is support and reliability. Any school district network engineers who have make the leap away from Cisco to save $$$&

Billion Modem and a UNIFI UDM PRO

Hello everyone,

Having some annoying issues with a new client we picked up. I’ve never had to deal with FTTN connections in Australia, all of our clients are on enterprise fibre (and this one will be too). But in the mean time, trying to get it all going until that arrives.

So they have FTTN and that is provided via a modem. We went out and bought a billion 8900x r3 to replace the ISP modem as it had minimal options and configurations.

I want to make sure I’ve got the modem on bridge mode however our WAN connection on the modem must be IPoE to get the VDSL connection.

Any clues on how best to do this?

I’ve also got a VPN issue where some clients cannot connect but some can and it’s constantly changing who can and cannot connect. It’s an L2TP connection. I’ve heard you cannot have multiple connections from one public IP connect to the single remote server using L2TP? Is that correct?

Rant Wednesday!

It's Wednesday! Time to get that crap that's been bugging you off your chest! In the interests of spicing things up a bit around here, we're going to try out a Rant Wednesday thread for you all to vent your frustrations. Feel free to vent about vendors, co-workers, price of scotch or anything else network related.

There is no guiding question to help stir up some rage-feels, feel free to fire at will, ranting about anything and everything that's been pissing you off or getting on your nerves!

Note: This post is created at 00:00 UTC. It may not be Wednesday where you are in the world, no need to comment on it.

Blocking a second router/dhcp source in the network

Hey all,

I am about to manage a network where users like to plug their own routers into the network, there is nothing I can do to stop it physically happening so i'm looking for a software solution. Each user pays for a cable connection.

What frequently happens is that they plug in the lan side of their router instead of the wan side, which breaks my network and is a big pain in the ass.

How do I block or override a second dhcp server on my network? What routers support a feature to deal with this?

RS-232 Serial Smart Switch Options

I am looking for an RS-232 "smart" switch that I can control with commands in the serial data stream.

In the past (like 17 years ago) I have used the B+B 232BSS4 (now rebranded Advantech).

The only thing modern switch I have found is the Digital Loggers RS-232 Serial Switch. It looks awesome for the price, but takes an entire rack space (I only need 4 ports, not 20).

​

The goal is to be able to hit a Sierra Wireless LTE bridge, a FortiGate, and a couple of other items by dial-up as a last ditch OOB management method. If I had more time, this would be a pretty simple thing to knock out with an Arduino or PIC.

​

Any other options?

Cisco 5508-X ASA >> FTD Migration FAILURE

So I am trying to change this 5508-x ASA to an FTD node.

I upgraded the firmware in ROMMON like suggested...got my TFTP server setup, and when I transfer the FTD code to the ASA it works fine, but the code never actually loads and the ASA never goes into the FTD setup prompts.

No errors, no failures, just the !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! transfer and a message that says it completed. If I look into DISK0: I do not see the transferred file.

The weird thing is the install guides always show the FTD software file with an extension of :

ftd-boot-latest.lfbf 

But when I go to the actual software page suggested by Cisco I get this:

Cisco_FTD_Patch-6.4.0.8-28.sh.REL.tar

​

Has anayone had experience with this? Getting a little frustrating and TAC is taking their sweet time.

NAS vs Internal RAID: Opinions?

Scenario: 6 workstations.

Option 1: 5 regular workstations with one of them having 2 internal drives configured as a RAID 1 to back up all of them.

Option 2: 6 regular workstations and a separate NAS device configured as a RAID1 to back up all of them.

Asking due to a client request....

FIOS for Business BGP Peering

Does anyone know if it's possible to peer BGP with Fios for Business? We have a site that currently has Fios for Business and we have 4 or so public IPs belonging to Verizon. We have a public /24 we want to move from another site to this site. The bandwidth we have is adequate we just need to advertise from this site, does anyone know if this is possible?

Cisco SDWAN Vedge in-line deployment

I am deploying a topology to simulate all possibles designs. I am struggling to configure vedge in-line, please refer to the topology. It seems that  vedge3 is not routing traffic from other routers (vedge2, on the topology). However icmp packets from the vedge(vedge3 on the topology) itself goes OK!    According to Cisco design guide we have to use a loopback interface, which I did, even though no traffic going thru.

Does anybody familiar with this kind of design?

PS:  I am not talking about tunnels at this moment, just basic connectivity between the routers.   Any help will be appreciated.   Thanks

any one using a repository for their network device configurations and templates

Ive been floating the idea around our team of setting up a proper repository for our network devices configs and templates. were just getting ansible stood up, and working to get that to use our templates we already have to generate config files, then eventually have it push the config to the devices. This brings us to where are we storing those config files. today any templates or config files are just stored on a shared drive, which i want to change so that they are securely stored some where with access control, as well as then having version control over the templates and configs them selves in that repository so we can use the repository as a source of truth. currently we are primarily a cisco shop, but were already planning to look at other vendors for a firewall refresh coming up in the next year or 2 and are wanting to start using SD wan for connectivity with our clients, which will likely not be viptela/cisco.

​

currently we do have backups occurring using solar winds of all devices, and while it generates nightly change reports to those devices, i feel its not the same thing as a version controlled repository that we could eventually tie into our ticketing system to monitor for deviations from the repository for a device and generate a remediation ticket.

​

we also allready are using netbox, which the plan is to use as a source of truth as well. it would provide information about device models and variable information that gets fed into the templates to generate the configs that are then stored in the repository. so basicly the information in netbox as a source of truth would feed into what is in the configs in the repository so the repository can act as a source of truth for the actual configs.

my team is new to automation, and trying to shift away from the spreadsheets and notepad documents stored on shared drives. are there any specific recommendations for repositories for the network side of the house? some of the other teams use their own repositories such as azure and git (open source), but im really not sure where to start in evaluating what our network team which focuses on routing, switching and firewalling, should focus on.

TFTP block ACK issue during PXE boot WDS

WDS pushing PE boot wim for workstation imaging. Everything else coming from the server is transferring fine (normal speeds), but the wim is incredibly slow (~35min 2GB file). Wireshark shows this interesting bit of interaction where the server re-sends first packet in the block at the end of the block causing it to fumble. So instead of

server sends packets 1,2,3,4,5 client sends ACK 5 

it goes

server sends packets 1,2,3,4,5,1 client sends ACK 4 

Here is a screenshot of the Wireshark captures. This doesn't happen on every block, but it happens enough to cause the slowness. Normally the delta between each packet in the block is ~20 microseconds, but when the block gets screwed up, the last packet the server sends in the block takes ~2 seconds. Now multiply that by 1000x it happens during transfer session and it quickly adds up.

I've tried:

• reinstalling WDS
• changing TFTP block size
• removed the Windows update from March 19 just in case
• reducing the wim size

I couldn't find much on this particular issue, so any help is much appreciated.

Phones register consistently using TCP, rarely/intermittently using UDP

I'm a bit stumped at the moment, hoping one of y'all could shed some light on this dilemma.

Network is setup as follows:

WAN----->
|
Fortigate (with public IP to WAN, and a private IP (172.x.x.x) to Sophos firewall. Managed by security vendor)
|
Sophos FW (w/ private IP to Fortigate (172.x.x.x) on WAN, private IPs on internal vLANs
|
Core Switch
|
Ubiquiti ACGen2 Fixed Wireless network
|
Site Switch
|
Yealink T54W

I'm pretty certain my vLAN config is good because the phones come up, get DHCP from my Windows Server (also connected to core switch), and will always successfully register when set to use TCP, but only sporadically/rarely when using UDP.

What am I missing?

Beginner's Problem: Why does my network manager not offer the required Encryption/ Authentication options?

I don't know if this is the right place to ask this, and I am sorry if this question is not as proper as it should be, but I am very confused. I am trying to connect to my local eduroam network as instructed by my university, and it doesn't work. I'm on a manjaro laptop computer, and I am very confused by the different network options. For example, the university's instructions say:

Encryption:  WPA2/AES

EAP-Type: EAP-TTLS

While my network manager does not even have those options for a wifi network. It has the following Security options:

- None

- WEP key 40/128 bits

- WEP key 128 bits

- LEAP

- Dynamic WEP (802.1x)

- WPA/WPA2 Personal

-WPA/WPA2 Enterprise

- WPA3 Personal

And as authentication method, it has the following:

- TLS

- LEAP

- PWD

- FAST

- TTLS

- PEAP

​

So my question is: Are WPA2/AES and EAP-TTLS just synonyms for something in the list of options that my network manager has? And is "EAP-Type" the same as "Authentication method"?

IPSEC and NAT

I need to set up a vpn between different locations, but can't figure it out.

​

Most of ours sites belong to a MPLS network, and get to internet through the same public IP address. I can use port redirection on this IP but only for UDP and TCP, not for HA and ESP. I hope ipsec can work with only udp port 500 and 4500 redirection, but I can't figure how to force it. Is it at least possible, it's not clear for me.

I have meraki routers in the MPLS and an NSX Edge on the other side.

is there a way to see option code values sent over dhcp?

I set an option code, 66, and it looks like it isn't sending a value. I am 90% sure. I want to see what it is sending. Is there a command or tool to do that? I basically want to see value associated with a DHCP option code.

Leaving Higher Education for Private Sector

I'm debating on leaving my job at a medium size public University to go back to the private sector. The move would more or less be about money. I've been here about 4 years, and in the private sector 5 years prior. I can't say I'm unsatisfied with my current job at the college, in fact it's a good job for the most part, but I'm not satisfied with my pay, and with how budgets have been affected by Corona, the attitude from upper management is be happy you have a job.

I've had to fight for every raise I've received, and I'm getting a little tired of the grind to make what I feel I'm worth. My own manager has vocalized that I should be making more as I'm making less than others on my team with the same (if not more) technical expertise. That is not going to change with salary freezes for the foreseeable future.

Work/life balance is pretty good but I wouldn't say it's dramatically different than when I was working at a large corporation. In fact, at times I'm killing myself as you get hemmed into wearing a lot of hats in this environment. If I left I'd be forfeiting my pension, but receiving a refund of the contributions. So, it would have to be worth it money-wise.

I'm just on the fence, I suppose. Has anyone on r/networking moved from a decent/good job at a University back to the private sector, and what was your reason, and experience like?

Short run through residential attic to under exterior soffit of ethernet need grounding?

I was reading that any time you run ethernet on the exterior of a building that you should ground it. Are there exceptions? It's for a POE camera a few feet outside a of a room. Would seem silly to run fiber into a fiber to ethernet switch for such a short distance?

F5 - persistence across pools?

Hi all,

In the F5 BIG-IP world, is it possible to have persistence across multiple pools? The caveat being those pools have the same nodes but on different ports.

The issue is I have multiple servers with the same services on multiple ports (3 different ports).

So, i have 4 servers, listening on 3 different ports each.

I don't think I can use one pool, because my health monitor will only reflect the health on a single port (which is no good if the service fails on a particular port).

So I figured i would create a pool for each port with each node in it on that specific port.

I then have an irule that picks a pool at random and a node is then picked randomly from that pool.

The issue is with persistence, it isnt working. I created a cookie hash profile and ticked "match persistence across pools" but it still doesn't work. I believe this is because F5 state the pool members have to be same node + same port.

Can anybody think of a solution to this?

Thanks

LRAT-2000 vs CIQ-100

I'm in need of testing some network cables and I'm looking at a cable testers. I run under the, "Buy once, cry once" type of attitude. It seems that the LRAT-2000 does everything the CIQ-100 does, but it doesn't certify the cabling? If I buy the LRAT-2000, would there be any situations, where I'd wish I had a CIQ-100 instead of the LRAT-2000?

Checkpoint Site-to-Site IP SEC VPN

We've just set up an IP SEC VPN between us and a third party.No NAT has been done, and so the disable NAT inside tunnel checkbox has been 'checked'.

Tunnel seems to be ok but intended traffic is dropping and i cannot understand why.Then encryption domain of the customer that's been configured in the VPN community has the subnets configured which we are dealing with on the other side.In our encryption domain, i added the device in question that needs to be accessible, being an internal FTP server.

Now the thing is that FTP traffic to this internal severs is dropping and i cannot understand why.IPSEC rules are well above the regular firewall policy.

How can i troubleshoot this further to get to know where i'm doing something wrong.Phase 1 and Phase 2 tunnel is established, only the traffic is not flowing.

I see in the logs that the traffic is being decrypted. Then i see it's being dropped due to not matching any rule? But like i said, IP SEC rules are well above anything else.

Encryption domain customer -> device on our side (internal FTP)
Service any
VPN domain VPN community configured for this customer
Accept
Log

To be clear, i'm by far an expert and it's sometimes a pain to get something regular to work, just like this.

All help is much appreciated.

Standardized Network Dokumentation Norm

I came from an Industrial Backgound and startet as an Electrical Automation Engineer and switched latter first to Industrial IT and now to Corp. IT.

Somthing that i noticed throughout different Companys regardless of there Size the Networkdokumentation was always poor. Some use tools like FNT Command, Pathfinder or imVision, most of them use excel or Visio or my favorit they use there Brain to remember all of the topologie.

Never did i came across a Organisation that said we follow the Standard X.Y.Z.

In the Industrial Sector, there is something Called P&ID Diagrams its a Standadized pictogramic Language to Dokument and discuse a Asset, Maschine, whatever. Every Department from, Mechanical, over Electrical to Prozess Controles and Chemists know this language and use this diagrams to Comunicate in one Language.

It seams like everything in Corp. IT now is Regulated and Standardized excapt this.

Now all of a sudden you start deploying Zero-Trust-SDN-SDWAN-BuZZwOrD-Stuff and ask your Personal (Developers, scientists, Fasility-Manager, and what have you) to layout what connections their services need and they look at you as if your a Alien.

Sounds Familiare to somebody? Or do i life under some giant Rock.

How do you handel this?

Confusion

Hello, i am 2nd year student of information technology and one of my friend are asking me to add 2 more routers on their internet. But im confused when i saw what they did there.

So theres a modem > switch > router 1,2,3 Is it okay to use a switch for multiple routers ? Or do i need to have a main router and make it DHCP server ? Im confused what action should i do to fix that.

STUN/TURN SERVER

Dear community,

if I want to make a Raspberry Pi accessible over the internet does it make sense to use a signaling server as done with STUN/TURN with WebRTC?

I would like to make a connection between two remote applications to exchange json data without opening a port on the home router.

Regards,

kaluzo

Tablet

I’m constantly on the move as of lately and I’m considering on finding a new employer for a change of scenery.

I want to utilize a tablet to help study for some certs as well as use networking emulators like GNS3 or Packet Tracer while on the go.

What are some recommended tablets that can handle emulation? So far I’ve read that iPad Pro and Surface Pro are top contenders.

Thanks for your advice!

Is this a good firewall design?

Hello Reddit mates,

I am working on implementing a data center firewall and F5 (WAF) with the following consideration:

• To secure and control the access from the user (access layer) to server farm such as IPS, Access policies, AV
• To secure Web Servers in DMZ
• East-West traffic inside server farm for stopping malware propagation for critical servers.

Please comment on this design, if it is good

https://www.dropbox.com/s/r1l14k0z85mp3iz/design.jpg?dl=0

Switch Suggestion for a Small Office (one switch or two?)

Earlier this year I took over the Sys Admin role for a small local government agency. One of the upgrades that I was advised to schedule (by the predecessor) was a switch replacement, but I'm not too sure what to purchase.

The building currently has 2 separate lines coming in, one from the State and one from a local ISP.
The State line is only used for emergency services. The ISP line is used for everything else.

My predecessor used a single ExtremeNetworks POE switch and split the ports into two groups. State ports and ISP (everything else) ports. Currently the switch has a little over 85% port usage. We utilize a handful of VOIP (POE) phones and around 35 end user devices. There will be little need to add new devices to the network in the near future as all the offices are full. Less then half the staff are onsite at any given moment.

​

Here my questions:

1. Should I buy 2 switches to replace the one? The network is very basic, no VLANs or anything more advanced. I'm leaning towards replacing the one switch for two but I'm unsure if there really is a benefit outside of redundancy. The State services could theoretically fall back onto the ISP ports in a pinch but would not be a long term solution.
2. What would be some reliable brands for switches? Uptime is a must. I'm only familiar with the Dell OS10 and older HP Networking (non-Aruba) switches.

Any input is appreciated! Thank you!

Need help to figure a Network tunnel

Hi y'all

So I have been able to yet 2 ranges of public IP addresses. One /31 and one /28.

They are assigned to a VPS wich also has one public IP to access it.

What I want to do is redirect the/28 network to my homelab, using the less possible IPs in it. How could I do this? Would BGP over a GRE tunnel would be the way to go?

Tske note that the homelab is behind a home ISP connection, wich does not allow the BGP protocol.

Would I be able to do this setup over a ZeroTier/similar connection?

Thank you :)

BGP to the server

I'm trying to come up with a way to get rid of vlans in our datacenters, so having the servers be dual homed to two TOR switches and running BGP with the tors make's sense. I want to use link-local addressing where the ToR will establish BGP with any neighbor that request it.
I've mostly got a good handle on how I'd want it to work, but I'm looking for blogs/write-ups, or even just brainstorming potential details. Should the server run FRR? Zebra/Bird/Quagga? How should an unconfigured server bootup initially? PXE, then download a configuration file for it's BGP agent? We have Chef available, but I'm not super familiar with all of it's implementation details or it's limitations.

Anyway, what do you guys think? What kind of gotcha's would I face?

NG-MVPN to Replace PIM in Multicast Domain?

I've been going through coursework for CCNP/JNCIP and have been fascinated with MP-BGP Next-Generation Multicast VPNs. Most of the examples and use cases provided in study material are obviously for allowing customer multicast traffic within a L3 MPLS VPN. That is, the provider runs PIM within a VRF, but can then signal through the provider network using MP-BGP.

At work we offer IPTV services to customers and I was curious if NG MVPN would work as a replacement for PIM. That is, would NG MVPN PEs work as designated routers, receiving IGMP membership reports and issuing Type 6/7 NG MVPN join routes? Basically, could you put your multicast domain in a VRF and replace PIM with MP-BGP?

How to modernize your captive network

https://developer.apple.com/news/?id=q78sq5rv

Reseting HP procurve 1920 Password Only

Hi,

I was wondering if someone could shed some light on the issue im having, Recently cant seem to get into the admin web on the switch which i need to reset only the password, As i cant reset the switch itself because i forgot what VLANS are in which port.

I was reading this https://www.reddit.com/r/networking/comments/4cccrs/reset_admin_password_on_hp_procurve_1920/

​

The part i get confused is on number 7 enable full command line mode as in https://www.reddit.com/r/networking/comments/2nl4g9/hp_1920_cmdlinemode_password/

​

So after im in the boot menus i press 7 then enter, then 0 reboot

I get the console mode but not sure whats the next step

​

Thank you

RRAS unable to connect to VPN clients

Hi All,

I have setup a VPN using Microsoft RRAS. My VPN clients can connect okay and are able to access devices within my LAN.

The issue i am having is being able to connect to the VPN clients from the LAN. I am even unable to connect to the from the RRAS server itself. I have a default route on my main router pointing to the internal interface of the RRAS server for the VPN subnet, but now connection (ping, SMB, etc).

Does anyone have any experience with RRAS and know what im doing wrong?

Enabling/Disabling AP radios on cue

Hi all,

So I've gotten this strange ask from my users which I don't know how to handle. I manage the network of several schools among other locations, and basically they want to shutdown the wireless at the schools after XX:XX hrs , it varies between schools. The motivations is that basically students hang around the school after hours and basically break sh*t. And for some reason everyone thinks it's because there's free WiFi.

We're a Cisco shop with the following to my disposal:

• 5520 N+1, Code 8.3.150.0.
• Cisco Prime 3.7
• Cisco ISE 2.7
• All APs run local mode, models 18xx, 28xx mostly

​

We have the same SSIDs at all schools which are:

• One "main" SSID for EAP-TLS, PEAP authentication which both students and teachers use. (Machine authentication and AD username/password)
• One WPA2 SSID where everyone knows the PSK, can't fix this yet, intend to use iPSK when we get to 8.5.
• Open SSID, splash page to accept EULA only.

Since these SSIDs are published not only at schools I can't simply disable the SSIDs using prime configurations tasks. What I've done so far for some schools already is to create a scheduled configuration task in Prime, which basically disables the radios for all APs at these specific sites at specfic times and then enable them again in the morning.

But now I've been asked if there's a way that teachers/principals could on cue activate the wireless if they wanted to after the specified shutdown hours in the case of special circumstances. This is where my head started to hurt. Is there such a solution? How?

​

My thinking to fix this long term is to make some changes to our ISE policies, by starting to utilize the cisco av pair attribute and tag student devices as 'STUDENT'. And then in WLC create ACLs per AP-group deny traffic for students after say 19:00 or whatever is requested. This would allow teachers access to wifi on our main SSID and deny students. I think this is possible, am I right?

The second WPA2 SSID I can't really do much about right now. But can probably fix this in a few months.And the open SSID I have to get rid of. Create a different open SSID that's only pusblished at schools and simply disable and enable this using prime at specific times everyday.

If anyone got any ideas I'm all ears. Have you ever had to deal with something similiar?

"a cry for help" I need help fixing and setting up a network

Hi, So some background info, I am a computer science student currently, but my main expertise isnt networks, unfortunately I need to help out a family member that is in trouble, his main IT technician who is responsible for setting up the network at his work just left, and he didnt complete his job, and thats where i come in. Ive looked around and with my basic knowledge and some help from the internet ive gathered some info about what he did and didnt but my basic knowledge isnt helping me get the whole big picture since there is a lot of stuff that just keeps going wrong whenever i do some simple steps that i never thought would have such reprecussions.

He setup several Cisco SG 110 and 350 switches of different number of ports, 20 and 16. An issue I am facing here is that I dont really comprehend how setting up a switch works, from what I know, is that a switch is basically an extender for my modem, since for example i only have 4 ports on a modem and I have 10 PCs, then I have to get a switch so that I could plug in the rest, basically get one from the modem into the switch and connect my PCs to the switch, and basically voila everyone is connected, but what I am seeing right now is making me feel there is very much a lot more to it than that, especially after I read how there is a managed type of switch, smart switch, normal? switch.

There is also a windows server 2012 booted off a usb, now, from my knowledge which is unrelated to networks, booting off a usb is risky but for some reason he thought it was safer? Isnt the main case but just wanted to mention it. So the windows server, what is it? what is a server? All i knew and thought a server was, was basically that its storage that could be shared over the network. obviously not the case. and so where should I look or what do you recommend I do to know what to do with this?

The mess up that made me feel this is going to get out of hand is that, they were operating off of one 4g modem since the telephone cables/internet cables havent been connected to that part of town yet, and so it was ofcourse extremely slow, due to the number of people using it and due to the modem itself being very weak and internal antennas etc. So what I did was basically get a couple of stronger modems with higher speeds and external antennas, and I am sorry if it makes you feel bad, but just connected them to the network... Ofcourse if you know your stuff which I didnt and only found out after searching, the computers were assigned different IP addresses via the DHCP and for some reason some lost access to the network, i.e. the files shared on the windows server pc, and some lost access to the already weak internet that they had.

That sentence itself i am not honestly compleletly sure i understand it fully, that they were assigned different IP addresses via the DHCP, first off, what is the DHCP? and why did it change the IP addresses? and why should it matter that the IP addresses changed? if that is indeed whatever actually happened. A comment made by a sub technician working there is that we also need to stop the "DNS"? My knowledge on all of this basically is, IP address is the "number" of the PC, the DNS is the "phonebook", the domain would be the name but i cant see where it fits in this whole thing, and so why would changing the IP address stop the internet? and that the DHCP is something that is in the modem that assigns IP addresses automatically...

I can already expect if anyone is going to comment is that they would say, find someone and pay him, but we are already on a tight budget and without revealing too much info there isnt a lot of people we can trust here with setting it up, especially after as I said the first one just "abandoned" us.

I am ready to do the research and work, I just hope that if someone has the patience, time, good, that they would help out by anything, explaining or directing me, anything.

Thank you and good luck with everything.