Saturday, February 13, 2021

Script Python net_connect with Netmiko for router cisco error

Hello everyone I want to make a Python script with a menu and several possibilities but I have a problem. When I run my script everything works

I can type the information to connect but I have the right to the following errors:

Traceback (most recent call last):

File "test.py", line 38, in <module>show_int()File "test.py", line 24, in show_intoutput = net_connect.send_command("show ip int brief")AttributeError: 'NoneType' object has no attribute 'send_command'

Here is my script I have tried a lot of changes but I don't see where the problem is.

Thanks for your help

from csv import reader from datetime import date, datetime from netmiko import ConnectHandler import getpass import os def get_connection(): device = { 'device_type': 'cisco_ios', 'host': input("Host: "), 'username': input("Utilisateur: "), 'password': getpass.getpass("Mot de passe: "), 'secret': getpass.getpass("Mot de passe Secret: "), } net_connect = ConnectHandler(**device) net_connect.enable() def show_int(): net_connect = get_connection() output = net_connect.send_command("show ip int brief") print (output) def show_route(): net_connect = get_connection() route = net_connect.send_command("show ip route") print (route) print("1: Show int") print("2: Show route") choice = input("Make a choice: ") if choice == "1": show_int() elif choice == "2": show_route() 


Is there a salary ceiling for network engineers who choose to remain forever in technical line?

If a network engineer chooses to remain in technical line rather than move into a management position eventually, will he hit a salary ceiling?

But if there is scope for high salaries, can you give some examples of such positions with median salary and skills required to attain that position?



Ideas for LACP on two VDSL lines

Hi,

I’d like to aggregate two regular VDSL lines for load-balancing.

Thinking about using the Unifi Security Gateway Pro to load balance the two lines, however there’s no modem functionality included.

Features required by business use-case: - VDSL modem (PPPoE) - 2x WAN ports - WAN aggregation support —> real load balancing, not just fail-over

Could someone share any experience on this topic?

Thanks I’m advance!



Small Office build

Moved into a new space, three small businesses sharing a 5000 sqft office. Building is already wired with about 40 cat5e wall-jacks throughout. Single story, brick/concrete perimeter and drywall/lumber interior. Half the building is open desk stations and lounge, 5 private offices. About 15 people currently working during the day, future growth could see up to 30. Currently most users are wifi-only for internet access and shared network printer. Typical use is emails, zoom conferences and browser based tasks. That's it. About 4 workstations want hard-wire for periodic video content uploads/downloads. There's 8 smart TV's in the building, one has as raspberry pi 4 running a lounge room dashboard display. 3 private offices have philips hue lighting with a single hue bridge. And there's 4 generic wired IP securities cameras. Full height server rack already in place in a dedicated IT room with mini-split HVAC system, battery backup and 3 ready to go wired patch panels. All it needs is switch/router/firewall/IP camera recorder. No phones. Gigabit Google Fiber is getting installed next week.

Here's the configuration I'm thinking:

  • Unifi Dream Machine Pro
  • Unifi Switch 24 POE Gen2
  • 2x UAP nanoHD on far ends of the building,
  • 1x UAP AC PRO in the middle of the building where most of the smart TV's are.

I'm not a really an IT professional--just tinkered with my home network, I run a small video production team. So Ubiquiti looks really appealing to me for ease of use and deployment. I don't have much time to fool around with it once we get it up and running. I just want to make it go and walk away for a couple of years until we need to change something.

Thoughts?



Looking for various case studies of network architecture and migration with concurrent availability

I am working as an intern/apprentice in a 6 month project, that is migrating an existing enterprise network that has been messed with by multiple vendors, and needless to say, runs inefficiently. I will have the guidance of my mentors while participating in the project, but it was suggested to familiarize myself in the high level overview of what this kind of project entails, and find some case studies of similar projects so I start getting an idea of what we will all be tackling.

The company has about 400 employees, spread between three campuses, the first of which is the headquarters, the second is a manufacturing plant in the same city, and the third is another business they recently purchased in another city. There is a fourth network at play that is the datacenter accessed via two separate ISPs, and located in another state.

We will build out the new network, load test, test transition, migrate, and have them running concurrently for a month before taking down the old network.

I'm new to the industry, so I am looking for some resources or shared documentation created by architects and network admins that give some details of how to plan a project like this, how it was executed, and the lessons learned. Kind of the sort case study you'd learn about in a college course, so I know going into the experience what are the high level issues I need to look at.



How to build your own video focused website infrastructure?

I have a video website I want to deploy as a startup. If possible, I would like to build out my own infrastructure and rely less on third-party companies like AWS, digital ocean, vimeo for video hosting and would rather host them myself. These third parties also have strict ToS and less reliance on them would be ideal.

I saw that companies like https://sibyl.li/ advertise unlimited bandwidth. Does this mean that if I pay for dedicated web servers with them, I could use the server storage offered to host the videos without needing to buy a vimeo membership? Does unlimited bandwidth mean free bandwidth?

What is the difference between bandwidth vs data transfer and the cost differences?

I imagine there would most likely be performance issues if I store the videos on the same server as my code. So multiple dedicated servers would probably be needed for load balancing? How would I resolve the performance issues?

What hardware does everyone recommend nowadays for starting out with your own infrastructure? Should I order servers online to be delivered to me and set them up in a data center near me or use dedicated servers that another company manages offshore but the linux OS I have control over?

If possible, I would like to be as cost efficient as possible. But if paying more is needed for less reliance on these third parties, I am for it. I would like to get an idea of how much I would have to pay monthly for some of these things. Data center costs, bandwidth costs, etc.



5GbE Not Much Better than 2.5GbE

I have been testing various 5GbE and 2.5GbE network cards for use with a couple of computers that only have PCI Express 3 x1 slots available. I am not using a switch; I am directly connecting between the cards with a CAT 8 cable. The 5GbE cards use an Aquantia AQC111C chip and the 2.5 GbE cards use a Realtek RTL8125 chip.

Copying files that are shared via SAMBA yield an average read/write of about 305Mb/second using the 5GbE cards and about 275Mb/second using the 2.5GbE cards. The read/write activity is between a 2TB Samsung 860 Evo SSD on the server and a 500GB Samsung 860 Evo SSD on the client. I also ran iperf3 to eliminate the file sharing protocol and I am still not finding a substantive performance difference between the 5GbE cards and the 2.5GbE cards.

While I don't expect to see double the performance, I thought I would see read/write performance close to the native SSD speed with using the 5GbE solution. I have not done any performance tuning and the MTU on each system is 1500. Is there any reason to expect I can get much better 5GbE performance by changing default settings, or am I expecting too much from 5GbE? At this point, I'm inclined to stick with the 2.5GbE cards because they cost half the price of the 5GbE hardware.



Difference Between Hardware Firewall and Software Firewall

It is possible to split firewall models into two groups: a software firewall and a hardware firewall. Software for the firewall is security software mounted on a device or server. A hardware firewall with a dedicated CPU, memory, operating system and software is a standalone unit. Often, certain hardware firewalls are part of and are built into the router.

The distinction between firewalls for software and firewalls for hardware is embedded in their capabilities. To compensate for the other drawbacks, both firewalls should be used in networks due to the variations between the hardware firewall and the software firewall and the advantages and disadvantages.

What Exactly Is A Firewall?

A firewall is software or hardware that surrounds a network or computer device, like a security fence, and protects it from cyber threats. We can consider the first security barrier to network input to be a software or hardware firewall. Thus, before it can access your network from the Internet or other networks, any data must first pass through the firewall. But how does a firewall detect what the network boundary does and should not cross?

The firewall checks the data packets for this reason, including the source and destination addresses of the boxes, complies with the collection of network rules, and decides whether the package is permitted to pass. To avoid unauthorized access or the entry of viruses and other malware into the network, malicious sites can be blocked by setting up a firewall. Either software or hardware are firewalls.

What Is a Software Firewall?

The program that is mounted on a device or server is a firewall. The Windows VPS operating system's proprietary firewall, accessible from the Windows Security Settings panel, or Pfsense for Linux VPS, is one of the most common software firewalls. Security software companies (Kaspersky, Panda, etc.) often manufacture their firewalls, which typically come in various versions. Some of them are intended for personal computers, and others are designed to be mounted on network servers and business environments.

Other network computers would be under their protection umbrella with only one installation on the server because otherwise, any computer connected to the network should be worth it. Purchase and install a separate firewall, which costs a lot and takes a lot of time to install and run on dozens or hundreds of computers. Some software firewalls can also control outgoing network traffic, in addition to tracking incoming network traffic. Furthermore, software firewalls typically have more choices and settings for protection and are more versatile.

What is a hardware firewall?

A firewall has a dedicated processor, memory, and operating system and is a standalone hardware unit. Some standalone hardware firewalls are built to be mounted in server racks because servers and other network equipment are installed within the stand and have a regular capacity in many medium and large networks. Instead of a standalone computer, several hardware firewalls often form part of a network router. In other words, there is also an internal hardware firewall on certain network routers.

The hardware firewall is positioned between the router and the outside world at the network boundary (Internet or other networks). It is the first line of defense at the entrance to the network, thus. Before it hits the router and then the computers on the web, all data must go through the hardware firewall.

Another benefit of a hardware firewall rather than a software firewall is that it conceals from the outside world the device or local area network. Thus, the external monitor sees only a hardware computer that has an unknown operating system instead of the network (because it was said that the operating system of the hardware firewalls is proprietary). This secrecy approach is called the translation of network addresses (NAT). This measure does not, of course, operate against the introduction of e-mail viruses.

What is the difference between a software firewall and a hardware firewall?

With a single physical unit, hardware firewalls allow you to secure your entire network from the outside world. Between your computer network and the Internet, this system is installed. A firewall of hardware tracks data packets as they are transmitted. According to predefined rules, the firewall then blocks or transfers the data.

Dedicated hardware firewalls require the installation of advanced IT expertise and typically require monitoring and management by a loyal IT employee or department once installed. Hardware firewalls are also commonly used by large corporations or businesses where security is of the utmost concern. Today, most routers have simple firewall features, but these devices are intended for home or SMB users. Compare this with software firewalls that provide a network with internal security. On an individual computer, a software firewall is built, and it protects the particular unit. The program must be installed on each system if several computers need security. A software firewall regulates the behavior of specific applications. You may block access to certain websites or a printer that is mounted on the network, for example. If a threat manages to infect a computer, software firewalls are also helpful, as they can secure other computers linked to the same network. Since they are simpler to build, many homes and SMB users would use a software firewall. A free software firewall requires any Windows OS newer than XP. Also available for purchase from several trusted vendors is separate firewall software with more robust features.

Hardware Firewall Advantages

As the software firewall is mounted on a device or network server, the hardware firewall protects the network one step ahead of the software firewall. Still, the hardware firewall is placed even before the router and right at the network boundary. A hardware firewall can protect a whole network. In centers that have several computers, this feature is handy and economically cost-effective. Independent hardware firewalls that do not install on another computer, such as CPUs, memory, and proprietary operating systems, are more powerful and faster than software firewalls. Hardware firewalls are more resistant to malware because their operating system, which is more popular with hackers, is different from standard operating systems such as Windows. If you’re looking for a hardware firewall for home then it’s better to start looking into different guides first.

Hardware Firewall Drawbacks

For beginners, configuring enterprise hardware firewalls is difficult. Hardware firewalls are not appropriate for outbound traffic tracking.

Software Firewall Advantages

Firewalls for home software are typically inexpensive, and some are even free. There are also multi-user licenses for their technical and business versions and can cover all systems on a network.

It is easy to install and configure standard versions of software firewalls, and with only a few clicks, the appropriate level of protection can be calculated. But there is more experience and skills needed for organizational versions. In addition to incoming traffic, some software firewalls can track and refine outbound network traffic and are superior to hardware firewalls in this regard. Firewalls for apps are more versatile. For instance, using them will restrict the access to the network of some programs and thus reduce the risk of infiltration of some malware. Since they are mounted on a device, software firewalls, specifically single-user models, are more removable, meaning the computer comes with a firewall wherever it goes. For those who frequently travel with a laptop, this function is essential.

Disadvantages of Software Firewall

The software firewall uses the host system's resources (CPU, memory, etc.) and can decrease its speed or output as a result.

The more computers and systems on the network are available, the higher the cost of buying firewalls for applications. As it is not cost-effective or time-consuming to use single-use software firewalls on such networks, you must purchase a copy that supports all systems. Furthermore, insensitive and corporate environments, cheap or free firewalls are typically not very effective.

What kind of firewall do we need?

Most of the decision depends on personal factors and desires. A hardware firewall would better support laptop users, whose machines seldom change networks. Combined with the most excellent versatility, it provides the most straightforward setup. A software firewall should be used by notebook and laptop users, especially those who frequently travel, to ensure security no matter where they are. You may choose to use both for total security — a hardware firewall while running on a home or office network and a software firewall while you're on the path.

Check out: How To Prevent The Common Cyber Attacks In 2021



Study References for SD-WAN

I am writing a dissertation on SD-WAN from the theoretical foundations to different vendor implementations and use cases. And then a simple/semi-simple design and implementation of an SDWAN network in a virtual environment (GNS3/Eve-ng).

I know dissertations aren't the niche of this sub, but this is more of a technical than academic endeavor in the real sense, so I need help with Books, Videos, RFCs, Courses, Experiences, Use cases, etc that can help in developing an in-depth understanding of things.

Any resources and insight provided will be greatly appreciated.



Friday, February 12, 2021

Reference material for Y1731

Looking to understand more about the Y1731 test suite and how I would implement it in a production network.

Does anyone have any good reading materials on the subject?

Is anyone using this in their troubleshooting/service assurance bag of tricks?



Cisco 9200 EVPN BGP VXLAN Support?

I’m looking to deploy 9200 switches for access in our new site. I also plan to use router links between the access layer and aggregation layer. I’ve read that the 9500s support a capability that allows the L3 gateway to be shared across all access switches. This is done using EVPN MBGP and VXLAN. Does anyone know if this capability exists on the 9200 series? Any experience setting it up?



Any of you guys have a QoS tattoo?



HP Chromebook Causing UniFi AC Pro to Reboot

X-POST from /r/Ubiquiti

So very strange issue here. I have an AC Pro AP (4.3.28.11361) connected to a UniFi 8 port PoE switch, that has been rock solid for years.

I recently changed around some VLANs, nothing else, and now when a newish HP Chromebook comes online, the AP reboots every few minutes when it is connected. Total number of devices connected are around 20 total.

Chromebook usage is minimal, not streaming, etc. Chromebook has been in use for 1.5 months with no issues before I reconfigured the VLANs.

The controller is also in a different VLAN now, but the devices and the controller are 100% open to each other.

Topology is:

Internet == Fortinet 81F == trunk ==UniFi PoE SW == UniFi AP.

I have tried updating the Chromebook, Controller, AP & Switch to latest firmware, rebooting everything, testing the cables, etc.

It only appears to be triggered by the Chromebook. No other device.

Wired connectivity is not impacted.

I m network engineer for 20+ but troubleshooting this issue is bewildering me.

I almost feel like some sort of “magic packet” is being sent causing the AP to freak out.

Anyone ever see anything like this?

Should I replace the AP?



IP Addressing Help

Hello. I have a subnet of 192.168.1.x . I have a dhcp server handing out addresses form x.x.x.10-199. I have statics from x.x.x.200-254. I am in need of more ip addresses. Would like to open it up from 192.168.1.x-192.168.3.254. How can I do this with my statics in the middle of all of that? I have a pfSense on the newest build. What would you make the subnet mask? Do I have to move all of my statics or do I just add another dhcp server to hand out from 192.168.2.1-192.168.3.254?



Catalyst 9500 And 4X10G Breakout

I'm trying to get a link up between a 9500-32C and Meraki MS425. I have a 10G single mode optic in the Meraki and a QSFP-4X10G-LR MPO optic in the 9500 with a single mode breakout cable. I can't get a link to come up. When I do a show inventory on the 9500 it sees the 4 breakout interfaces as QSFP-40G-SR4. It seems like the switch thinks this is a multimode optic. I reached out to fiberstore and they said this is just a display issue and that it should work fine but I can't get a link to come up. The 9500 is running version 16.12.4 so it supports breakout and it did split the interface out. I used port 27 so I now have hu1/0/27/1-4. Any ideas?



ACL to Datacenter - 1 Rule with ports required & servers or - separate by servers/port requirement

Hey,

We moved datacenters and currently for migration, the ACL rule from site to new DC all traffic is allowed to our DC subnet.

Our ACL configured to our old DC is seperated by servers.

I.E 1 ACL rule to our domain controllers only allowing the needed ports, 1 ACL rule to our fileserver only allowing SMB ports followed by a blanket denied all.

It got me thinking before I implement this again, is this over kill or should I just create 1 ACL which is something like INTERNAL -> ALL DC SERVERS allowing all ports needed instead of separating by server & port



FlexVPN Anyconnect vs SSLVPN Anyconnect

Hey folks,

I've got a shiny new ISR 4k to replace a podunk 2911 here.

It looks like the 4k is not going to be doing SSLVPN for me, so my question is if I run FlexVPN Anyconnect which is IKEv2/IPSec what sort of operational bullshit am I going to run into?

Back in the old days before SSLVPN, we had trouble with people doing IPSec based client VPN - particularly when trying to get through restrictive firewalls. That was the golden thing about SSLVPN, that it was port 443 so easily able to push through pretty much anything.

Since I haven't dealt with that stuff in a long time...what's the current state of affairs? Is IPSec based client VPN still going to give us heartache or have the clients become more reactive and able to accommodate difficult networks?



Python Int Switchport

I am running this script on 2 different switch stacks, both 3650s running 16.3.6. One is a stack of 3 and the other is a stack of 4

On the stack of 3 it only comes back with the 1sw ports.

When I run it on the stack of 4 I get all the interfaces from all 4 switches.

I can run it from the CLI with no issue and get all the ports on the 3 switch stack

from netmiko import ConnectHandler
from operator import itemgetter
from getpass import getpass
import json
IP = input('IP of switch: ')
username = input('Enter your username: ')
password = getpass()
SW = {
'ip':   IP,
'username': username,
'password': password,
'device_type': 'cisco_ios',
}
net_connect = ConnectHandler(**SW)
interfaces = net_connect.send_command('show interface switchport', use_textfsm=True)
l = len(interfaces)
print(json.dumps(interfaces, indent=2))

print ('total number of interfaces are ' + str(l))



Aruba 2530 public/private traffic isolation

I have a small office that I want use a single switch for public and private traffic. Ports 1-36 are currently untagged and will carry traffic back to our main office.

Ports 37-48 are going to connect to the Spectrum modem and our wifi transmitter and the VOIP phones. I have designated these ports as Vlan [nothing else on our network]

What else can I do so that these two segments only speak to themselves?



MACsec : CPE choice

Hi !

I’m looking for a CPE, MACsec enabled, but I don’t find it.

I would like a small CPE with maximum 6 ports usable.

Except Adva and FSP-150, no vendor provide this type of equipment ?

Thanks.



Wifi and forgetting to log out (Gmail)

H.

If there are neighbors in your building stealing your Wifi and you forget to log out (Gmail) everyday can they read your emails even if they're not experienced hackers?

my router has TKIP/AES encryption and I rarely change passwords for Wifi and Gmail

I have very private emails and I belong to a persecuted group, I hope they didn't read my messages because my router sends signals even to the second floor even though it's in the fifth floor.

Do they have to be experienced hackers to read my emails and being connected to my wifi and forgetting to log out are not enough?

Thanks in advance.



Network Infrastructure accounts to follow

Hey everyone I would like to know what pages, podcast, YouTube Channels, and social accounts you follow ? New to network Infrastructure and would like to get exposed and learn as much as possible.

Thanks



Help me capture layer 4 protocol information for VPN protocols with Wireshark

Hello everyone,

We have a widespread issue with Cisco Anyconnect at our organization that I believe is being caused by DTLS. However the senior staff at my organization does not have a vested interest in actually providing long term permanent solutions to problems and as an IT person and junior engineer handling these issues I refuse to accept there isn't a long term solution to this problem.

So I am trying to prove it, document it and solve it myself (which is fine). What I am struggling with here is that the connection will drop every few hours for me (more often for others) so I am going to run wireshark in the background until the drop happens.

Rather than collect massive amounts of data I am wondering if there's a way that I can monitor the just the protocol information of the VPN failing over to TLS?

Can someone help here I am not a Wireshark savant yet.



The latest FMC / FPR issue

I'm hoping I can find someone with some idea what might cause this issue. for a system that is just supposed to work (determined this by the complete lack of troubleshooting tools or documentation) it simply does not. I've got a FPR-1010 running 6.4. it was configured in a test capacity in my office for awhile while I played with it. I was not entirely impressed with the non-intuitive way you setup these devices. without the quick start guide you'd be dead in the water. In this capacity I had it configured and managed by a freshly installed and configured FMC running 6.6. The fun stops here.

Yesterday I took my happy little guy to the next level and tried to put it into a production capacity at a different building. the building is connected via a wireless bridge. Everything in this new building is working correctly right down to the controller based wireless. after much unsuccessful attempting to change the configuration of the FPR-1010 I reset the device to factory and started over with it. I removed it from the Device list on my FMC. I configured the device according to the 6.4 quick start instructions. i.e. port 2 and mgmt ports are plugged into the switch, port 1 is plugged into the internet device (currently disabled because the internet circuits not installed yet; default route on FPR points to core switch which currently default routes back to the main building via the wireless bridge).

ran through initial configuration, set ip address and all that, setup manager to point to my FMC (this is all stuff I had working in the other building). so I go to add the device back to FMC and the device will not add. I've confirmed I can ping and SSH from the vlan with the FMC to the new device. I've confirmed the new device can ping back to the FMC. so path and routing does not appear to be an issue. what have I failed to do to make this device add?



Finding out what devices are connected to network

Looking for any ideas how to monitor what devices are connected to the network. There are many different departments etc. always adding and removing devices and in a time all the Excels and other databases/CMDBs start to become at least a bit outdated.

So I'm looking for a way to help validate the data in the CMDB by checking what we have actually seen in the network in the last month or two. As this wouldn't be a NAC type of situation where we rely only on the profiled data, it can be a bit cheaper and less trustworthy solution. We'd then figure the rest out manually. We're going towards 802.1x all the time but also that takes quite a while and in the meantime we would need something :)

Some options I've thought:

  • Do MAB that permits everything but writes extra attributes for ClearPass endpoints (last seen switch/port/connection time)
  • Add a FortiGates to each aggregation switch and mirror traffic to FortiGate and enable device detection
  • Buy Clearpass device insight (though not sure if this would be beyond budget)
  • Buy linux boxes and use some security tool to gather data from mirrored port (any recommendations?)

Any thoughts or ideas?



Access router admin page

I have a question and I hope you can answer,
I connected a router to another router.
the router that is connected to the internet is: 192.168.0.1
and the other router that is connected to the first router is: 192.168.1.1
i can access the second router admin page: 192.168.1.1
but not the first, someone can help?



questions about wall cabinets and patch panels

Hi All,

Since beginning work at my current job I've discovered that, apart from one building in particular on-site, all of the other area's and buildings around site, which is quite a large campus, do not have patch panels installed in their wall cabinets. Instead, the cables in all of these wall cabinets around site have been run directly to the switches from the end devices, which I've come to understand is not what you'd normally see in most other enterprise organizations. This has meant that most of these cabinets without patch panels have become quite a mess and very unorganized. The cabinets themselves are also far too small meaning that if I were to push for budget to tidy them up, we'd need much bigger wall cabinets also to accommodate any new patch panels and cable tidy bars inside above the switches. I'm a network engineer yes. They hired me to refresh their network yes, but they allocated a cash budget only for upgrading the actual switches, and not for any additional work required to tidy up the cabinets. This is my first big project and I was fairly green before I started with regards to wall cabinets, patching and keeping things organized. What I'm hoping to do is install patch panels and have everything professional and tidy in every wall cabinet. I've already begun installing new switches to replace the old ones, but I think now if I had realized the extra work required to professionally sort all this out, I might have pushed back and told them we need to plan to address the mess in these cabinets. It really is just a mess and it makes swapping out the old switches extremely difficult and frustrating. In some cases I've refused to swap the switch out because the cabinet is so bad.

I've hired a contractor to begin work on one of the worst cabinets I've seen, a 6U wall cab crammed full two switches and three 24 port patch panels taking up 5 U's of space without any cable management, no space for cable management and you can't get to the switch at all because of all the jumbled up cables preventing access:

https://imgur.com/uC4kX78

https://imgur.com/HTcB7DR

I'm having it swapped out for this new 9U wall cab today:

https://imgur.com/i09l08X

I was thinking of having a go at taking down the old cab and putting the new one up myself, but I've never done it before and I don't know what tools I'd need. Can anyone tell me what tools I'd need? What are the screws, drills, drill bits, etc you'd typically use?

Also, notice that the old cabinet has three 24 port patch panels. I am thinking of having a go at patching myself, and what I thought I'd do to save space in the new cabinet is to take out two of the old 24 port 1U patch panels and install this new single 48 port 1U high density patch panel:

https://imgur.com/sxo39He

As I mentioned though, I have never done patching before. I asked the two contractors who are here today if they could take the two old 24 port 1U patch panels out and put this new 48 port 1U patch panel in, but they told me it will take at least a day or two, and they are only here for today to put the new wall cab up, because they said the new patch panel will require alot more work than I believed, because all the cables need to be fully tested etc. This is what I'd like to learn more about so that I can patch myself. Can anyone give me some pointers on how to proceed if I was to do this patching job myself? I already have the following tools for patching:
https://imgur.com/UkkuWdW

What other tools would I need, what tools do I need to test the connections after they have been punched down?



SR-MPLS for DCI

I'm curious to see how many people are moving from traditional LDP/MPLS to SR-MPLS for DCI to support multi-tenancy with VPNv4 or EVPN Multi-Site.

I've been working on it for a DC project to support EVPN multi-site and VRFs with Type-5 routes using IS-IS as the IGP for SR-MPLS. It's been great to work with even though we did hit a few bugs on the ASR9Ks when implementing.

I've been deploying SR-MPLS in service providers for a while in Nokia/Juniper but this is my first time doing it within the scope of an enterprise network on Cisco kit.

Just wondering if anyone else is using this in prod for DCI.



Probably a dumb question but here goes..

I can create vlans with a tplink switch.

What I need to do is have port 1-5 in vlan1 and 6-8 in vlan 2. The idea is to connect a router with dhcp 192.168.0.0 /24 in vlan 1

and a different router with dhcp in vlan 2 with 10.0.0.0/24

thus creating two seperate networks on one switch?

I have tried using 802.1q Vlans with all ports untagged. one vlan works but the dhcp on the other one won't.

what am I doing wrong, or is this even possible?



DHCP Option 82 for location based IP?

Is there any good information/examples on this? I've searched quite a bit but can't really find anything useful. So if someone has a link or just some simple example I would be very grateful. Or maybe a better idea on how to do this. Maybe a device in the middle with static IP which then forwards everything to the end-device. But then we have another point-of-failure.

I'm mostly confused about the hex pattern.

I want to configure Cisco switches to send the port info to our Windows DHCP server. Then assign reservation based on that.

Context: 24/7/365 environment and monkeys needs to be able to swap the end device. Production system looses IP-based contact with device since the reservation doesn't match anymore because of different MAC. Monkeys can't set static IP and certainly can not change reservation.



Thursday, February 11, 2021

Network Monitoring Packet Loss

So we’ve got a tool for monitoring up/down alerts. What does everyone use for monitoring packet loss and degradation? How do you handle moving traffic to a secondary connection automatically? SD-Wan solutions or failover and monitoring on firewalls?

Looking for ways we can streamline and improve our service to our user base. We are currently saddled to SonicWall firewalls so no hardware changes there at the moment. Might have an opportunity for other tools in the near future for monitoring. We are also working to update our sonic walls to recent versions to utilize the sd-wan component. Not the greatest but does what we need.



Looking for suggestions on cellular failover

Just like the title says. Spinning up a new office and the fiber connection is a little janky. Looking for suggestions or recommendations on cellular backup/failover. Will have a Cisco 5515-X with firepower as the security appliance and peak bandwidth can reach 160 Mbps. Connectivity takes priority over bandwidth. Data cost is also a factor. Prefer Verizon LTE. Can expect at least 1- 2 GB an hour.



Question on ACLs

Does anyone know of a setup that would use global ACLs or something similar? I have 10 sites that may need updated lists once in a while and would like to just change it in one spot.



AnyConnect Management tunnel

Our company is testing AnyConnect management tunnel. Everything seems to be working fine however we have a small caveat that is annoying. When PC boots we see the session created on the ASA so all is good, however when user logins and AnyConnect starts it does try to connect to the User Tunnel leaving the Username and Password prompt open. Which in the other hand shuts down the management tunnel.

The settings in both XML files look correct (either user tunnel or management tunnel).

<UseStartBeforeLogon UserControllable="false">false</UseStartBeforeLogon>

(...)

<AutoConnectOnStart UserControllable="false">false</AutoConnectOnStart>

ASA version 9.12 and AnyConnect 4.9.06037

Anyone that has gone through same issue?



Blogpost Friday!

It's Read-only Friday! It is time to put your feet up, pour a nice dram and look through some of our member's new and shiny blog posts.

Feel free to submit your blog post and as well a nice description to this thread.

Note: This post is created at 00:00 UTC. It may not be Friday where you are in the world, no need to comment on it.



Cisco SFP Module fibre compatibility with OM1 OM2 OM3

I need to make a fibre run between a Meraki core switch and a satellite switch. The length of the fibre run is 110m indoors / outdoors.

The SFP modules I have to work with are:

Cisco GLC-SX-MM
30-1301-02
Class1

My question is, how do I know which fibre type (OM1 OM2 etc) my SFC modules are compatible with please? I'm struggling to find this information online.

A bit more background: I'll use a bespoke cable service to have the armored cable made & pre-terminated with LC ends.
https://www.cablemonkey.co.uk/custom-fibre-pre-terms/13073-armoured-pre-terminated-fibre-cable.html

The cable maker offers OM1 OM2 OM3 OM4 etc. As this satellite switch is just for CCTV and access control; Gigabit more than meets the requirements. Looking on the chart (on the linked page) I see OM1 and OM2 will be just fine for Gigabit over 110m.

Any help appreciated, please excuse my ignorance 🙂



Meraki VPN and printing question

I am using a Meraki VPN and need to print to someone else's printer who is also using the VPN. I have no problem when the printer is in the office and I am remote, but when both are remote I am unable to add the printer. We are both on Mac, but I also have someone that needs to print from a remote PC to the same remote printer connected to the Mac. I am pretty new to networking. Sorry if this is not the right forum for this question.



Bridging 2 VLANs through MAN routers....

Hi, Looking for some advice / suggestions

https://imgur.com/a/BxGEJsJ

Here's a diagram of two sites in a MAN - We're having a new WAN service delivered and opted to have one leg at two sites (there are 5 man sites) so if one site loses power, the whole MAN doesn't drop off the WAN. The 'internet' cloud should actually read 'SDWAN', but it's still an internet connection I guess.

Today the Vendor advises that both WAN routers (EC01 and EC02) need to create a couple of dot1q trunks between each other, not have a layer 3 relationship as we planned.

My first though is a BVI - or Bridge domain as they're now called.

interface GigabitEthernet0/0/1.100 (existing site to site link)
encapsulation dot1Q 100
Bridge-Domain 100

interface GigabitEthernet0/0/3.100 (unused interface, plug into EC)
encapsulation dot1Q 100
Bridge-Domain 100

Anyone used Bridge-Domains on C4431 routers? Thinks it'll work? Has a much better suggestion?



Service Provider DHCP Server Software

Question for SPs. What software do you use for DHCP? Some providers distribute DHCP on a centralized L3 nodes (I.e. Cisco ASR or Juniper MX), but others use centralized servers. What do you use? If centralized servers, what software do you use?



Finding a good CAT7 installation cable

Hello everyone,

I'm from germany and I'm currently looking wich CAT7 installation cable I should buy. The prices of these cables range from around 40€ to around 100€ for 50m.

Cable 1 (85€)

Cable 2 (65€)

Cable 3 (40€)

All are 50m CAT7, Duplex, S/FTP, 1000mhz, AWG23. Why would I buy the expensive one? Can there actually be differences in quality?

Greets!



Network design question around micro segmentation

In short, I need to retain the IP address of devices (both wired and wireless) as they move between floors of a single building. This means the same vlan and IP space needs to exist on each floor, pushing L3 to the core instead of at the edge (like a different IP space for each closet). We are in the process of designing the IP space. For dynamic vlan assignment and segmentation with ClearPass to actually isolate the traffic I can't run a routing protocol since L3 is happening at the core layer. It will inter-vlan route the traffic that is segmented at L2 correct? This is a new installation of all Aruba CX switches and 500 series Instant APs. We have ClearPass already in place for basic .1x wireless. So am I stuck with static routes or is there a way to keep the traffic isolated at L2 and L3 with routing happening on the core layer not the edge.



I am unable to access a shared folder in the on-prem Windows Server VM from a Azure Cloud Windows Server VM. What could be the problem?

Hello all,

I am unable to access a shared folder in the on-prem Windows Server VM from a Azure Cloud Windows Server VM. What could be the problem?

In the on-prem VM, I have ensured the account I use in the cloud VM has access to the shared folder in the on-prem VM.

I have tried:

\OnPremServerName\SharedFolderName

and

\IP.Address.Of.The.On.Prem.VM\SharedFolderName

But neither methods work.

I am able to ping the on-prem server from the cloud VM.

The on-prem server is Windows Server 2012 and the cloud VM is Windows Server 2016.

What configuration am I missing?



Hi guys, I was doing some homework and I got stuck on this question, can anyone help me out?

For communication between remote processes / end points:

A) A 16-bit TSAP is an integral part of a socket-pair-address specified for both the source host and the destination host

B) For the operating systems of both remote hosts it will be sufficient to associate a 16-bit logical port number to each remote process, without the need for anything else

C) The source and destination hosts must always use sockets to avoid IP multiplexing



Home Office Recommendation on Router/Switch

I have a home office with heavy use network.

And I find the MikroTik Router is failing and dropping connections at times.

I Think I need an upgrade on the router

This is my set up.. What hardware would you recommend?

Current Internet Bandwidth

10Mbps UP, 300mbps Down

Current Hardware

[TP-Link EAP245](https://www.amazon.ca/gp/product/B07NMZR3F1/ref=ppx_yo_dt_b_search_asin_title?ie=UTF8&psc=1)

[Mikrotik RB4011iGS+RM](https://www.amazon.ca/gp/product/B07HBW2NTR/ref=ppx_yo_dt_b_search_asin_title?ie=UTF8&psc=1)

Current Usage

4 Smart switchs

6 RPis (webserver, homeassistant, etc)

3 Tablets (my 85 yr old Father-in-Law is addicted to YouTube and streams all day)

2 Laptops (Team video meetings, Video streaming, VPN to work)

2 Cell phones (if on wifi)

Any Suggestions are very welcomed



Anybody used the Brother PTE300vp for labelling in Network Environments - Specifically labelling cables.

Anybody used the Brother PTE300vp for labelling in Network Environments - Specifically labelling cables.

I’ve only ever used Brady in the past (excellent self laminating labels, but cost per label is high). The Brother labels are cheaper.

These Brother Label printers are going cheap at the moment (£49) and wondering whether they will be any good.

Just want to know your thoughts if you’ve used one in the past/currently.



Good networking certification for Software Engineers?

Hello,

my company asked me to find what certification would be the most appropriate to our needs. The purpose of this certification is to understand the main concept of networking. The certification should cover most of those topics (what are their purposes, how and when to implement them):

  • VPC
  • VPN
  • Interconnect
  • NAT
  • DNS
  • CIDR
  • IP Filter
  • Firewall

It's for a team of software engineers mostly working on data platforms and deploying softwares on the Cloud (only GCP and AWS). Most of them have very few knowledge of networking fundamentals. So far I found those certifications:

  • AWS Certified Advanced Networking - Specialty
  • Azure Exam 98-366: Networking Fundamentals (exam not certif)
  • GCP Cloud Network Engineer
  • Cisco CCNA Certification 200-301
  • Implementing and Operating Cisco Enterprise Network Core Technologies
  • Jupiter JNCIA-Cloud
  • Aviatrix exam

My boss told me that he does not think Cisco is great for us because it's covering too much and it's low level. Any advices?



Cisco SG-300 switches SSH dying after 10/15 seconds each time

Hi, I had to rack a pair of SG-300 Cisco switches (don't ask) in a medium sized network about 2 months back, obviosuly these types of switches are meant for a network that size in my opnion. But because the company didn't want to spend any money and them thinking they would be good enough even after me pressing the issue saying plainly in the end....THEY AREN'T!, they still went ahead and said that is the only option at the moment, so i went ahead racked them and isolated them as much as possible in the network. Today however I find myself having to remotely do a change on them (trunk port change no biggie) and I'm ssh'ing onto them and the connection will freeze and die within 10/15 seconds each time!

Goes without saying but nothing has been done to them since I racked and tested them onsite and remotely to. I was on them about a month back and everything was fine as far as SSH timing out goes which leads me to think that they're simply f*****!!!

Anyone anyother ideas, the exec-timeout and ssh timeout are fine to by the way.

Thanks everyone



Wireshark and RTP stream timing question

I have noticed a discrepancy with Wireshark and how it renders audio to a .au file.

Say I have a RTP stream (sequence numbers 1,2,3,4,5) , which drops 5 packets (6,7,8,9,10)..... naturally you would assume just 100ms of audio is lost ( 5 x 20ms).

The next packet (sequence number 11) then arrives with a delta time of 200ms.

This delta time, this is the time difference between packet 11 and 5.... which indicates 100ms of lost audio, and 100ms network delay, am I correct with this?

If I am, is there a way to export this total delay to the audio file, so I will see the 200ms of delay, or is it just how Wireshark works, where it will export audio as just a sequence of packets, regardless of other delay timings introduced (so I will only see the 100ms gap in audio when exported)



Wednesday, February 10, 2021

Concern over moving from VPLS to Velocloud SD-WAN

Currently we have a few remote locations connected via VPLS to a central location with a router at each remote site and another the main site. The remote sites act as if they are in our main network and of course pass traffic at layer 2. This is important to us as we use VLANs for network segregation and would like a similar method to what we have now.

We are looking to move to Velocloud SD-WAN but I'm worried that traffic won't be passed in a similar way to VPLS (or the capability to have something similar in this solution). I don't currently see it as a capability of Velocloud, though I also find it hard to see how it operates at layer 2...

Are there any insights into this or advice?



Secured Remote File Transfer and Storage Advice

Hi. We've been trying to make a secure storage and remote file transfers from certain individuals/companies. Right now, we are only using the usual email. Files being shared are just documents and not large videos or anything, but they are highly confidential so security is a must. So far, I've thought of 3 possible options:

Option 1: Cloud based File Server Storage. So far this seems to be the easiest although I understand that there are recurring service fees for these. Encrypting the file before uploading to the Cloud seems to solve the security issue with the Provider that might sniff into the contents. I have heard of Egnyte but need to research some more.

Option 2: On premise NAS (Synology) + Quickconnect - Basically no port forwarding needed on firewall as Synology will initiate the connection and data will use 443 port when using HTTPS. Downside is I saw some posts saying Quickconnect is not usable sometimes? Have any of you have some experience with this?

Option 3: Offline NAS + VPN - This is probably the most secure although more complex and I have no prior experience in setting this up. If this is to be done, this should be in a entirely separate network right because the remote users must not have access to anything aside from the NAS. How hard will it be to set this up? Any Firewall+VPN device recommendation I can look into?

So far, these are the options I've thought of. Any advice from you guys? Thanks!



IRF fails to come up after power issue

Hi folks,

I am looking to you guys for a bit of insight again. Forgive the length, but I’ve just pulled a double working on this issue and I need to process some info, if you’d be willing to bear with me.

Earlier today our site on the west coast had two blackout events back to back. The first one depleted our UPS’s and then the power came back on. The switch stack started to boot and then another blackout hit again. Because the batteries were depleted they died right away. Upon reboot only switch 1 of 2 in the stack came back online in the fabric.

The 2 switches are HPE FlexFabric 5945’s running in IRF using BFD-MAD. The first switch became pingable as soon as OSPF came up but the second remained down and unreachable. The IRF on the first switch did not list the second slot, so I had my on site contact reboot the second switch again. Still nothing. At this point I got HPE on the line.

HPE tech walks me through some checks and confirms config looks good to him. We discover that we can SSH to the 2nd switch if we plug into it directly (my tech didn’t have a serial cable...) and SSH to the management IP. So I’m controlling his computer and 2nd switch via cell/Zoom support session and the 1st switch using my normal method over S2S VPN.

We rebuilt the IRF config on both switches from scratch. We reseated cables, restarted switches, and each time we got the same result. The IRF port shows the right config but the port never goes from DOWN to UP, even though we know the ports pass traffic if we drop them from the IRF config. So cables and port seem OK. We even get LLDP changes initially on MAD port but nothing on the IRF ports.

As a last ditch effort, HPE guy drops BFD-MAD on both switches and saves the config. His theory was that the config on the second switch, which had the incorrect PVID on the BFD-MAD port, which we had fixed, was being overwritten by the first switch when the IRF merged. (We get PVID mismatch errors all of a sudden from LLDP on the BFD-MAD port in this case.)

He throws up his hands figuratively, and asks me to collect the diagnostic-information for both switches and FTP the logs to him.

Has anyone run into a similar issue before? IRF port refusing to come up and pass traffic, despite config rebuilds and cable reseating? I feel like these switches are gaslighting me or something, because I’ve not run into an issue this stubborn with them before. I’m not even certain the hardware wasn’t damaged because of this power issue, but I feel like I’m grasping at straws.

Thanks for listening. If you have any thoughts that may help diagnose or resolve, I would be infinitely grateful to you for your expertise.



Fiber link up/up on one side and down/down on the other side?

I ran into this issue today where one of our IDFs went down. How would 1 side be up/up and the other side be down/down? I ended up fixing it by using a different fiber pair, but I would assume if it was a bad fiber pair, that it would be down/down on both sides, wouldn't it?



Trying to get rid of ISP (Fiber) router.

I am trying to by pass my ISP (SaskTel) router and plug directly into the Fiber ONT box with my PFsense. I tried to get the ISP to help me, but they have no desire or idea how to do it. One tech said he knew someone had, but it involved setting up a vlan 100?? to do it.

I know this may be a long shot, but anyone have any suggestions?



OSPF route in database, but not in routing table? (LSA-7)

Hi There, an OSPF troubleshooting question here.

Issue: An OSPF NSSA area sees a default route in the database but that route is not being injected in the routing table.

I've checked that the NSSA forwarding address in the LSA-7 is reachable and not learned through an external route which would cause issues (see Why Are Some OSPF Routes in the Database but Not in the Routing Table?) and everything seems okay there.

The set up is as following: The ASBR, which is also an ABR, is redistributing into OSPF a default route. The forwarding address in the LSA-7 is seen across all the area and the forwarding address is set to that ABR+ASBR router loopback interface. So far everything seems correct.

How to reach that loopback interface is learned through OSPF intra area routes (i.e. non-external route) that means the entry in the database should appear in the routing table - but it does not.

Question: How do I continue troubleshooting what might be wrong with this route that should appear in the routing table but for some reason it is not?



Long Haul / Dark Fiber providers between California and Nevada

Hi experts! I've been tasked with finding out which providers have Long Haul or Dark Fiber routes between Barstow, Ca and Las Vegas, NV...is there a regional map that indicates which providers have routes? If there is a better Reddit sub-group to post on , please please me know... any help appreciated. Cheers.



NVIDIA/Cumulus

I'm curious at this stage if there is a mature alternative to NVIDIA/Cumulus? I was set to start discussions to implement them into our environment for a new site as opposed to Cisco gear only to find out about the Broadcom situation--meaning I would have vendor lock-in again with Mellanox/Spectrum which I wanted to avoid.

Has anyone been in the same situation?



Filling the DNS Cache with a list of popular sites?

I run pfSense with my dns resolver in forwarding mode and after looking at my dns hit rate it was only ~5% for multiple days in a row. I was wondering if it would be possible to create a cron job to fill the dns cache with a list of popular sites before the TTL expires. I know this would likely be very overkill, but I like overkill for my network!



Hey I just got a job working as a 5G test engineer and I need some help.

I am completely unqualified I think, it’s an entry level role. They said they’ll train but I would like to come with some knowledge on the subject. Here’s a brief description

Description • Interact closely with customer to understand EPC / 5GC Test automation requirements, and drive internal development activities.

Understanding of call flows 5G network architecture and services

• QA or relevant experiences in EPC / 5GC or IMS.

I was wondering if anyone had any YouTube videos or books I could digest to get an understanding of this subject. I have some IT background as a manual and automation tester for 1 year. Sorry if this is the wrong sub and thank you in advance



Recommendations for iDRAC Network?

Hello, hope this is the right place to post this question: I do have some <15 servers at work and I would like to set a network of the IDRAC cards to manage the servers remotely. I wonder if it's good practice a completely separate and independent Ip range and VLAN for that or you just use same IP than the servers? In advance thanks for the help



How to create a network topology map

Can anyone tell me what tools they use, or how they create a network topology map from the internet off the street al the way down to end points?

I recently started a new job as a network administrator and need to get a good handle on how the network is laid out. All the tools I’m finding are paid and extremely expensive.

Any help or advice is welcome!! Thank you in advance!



Have you caught suspicious activity from a third party?

I was reflecting on my career over a glass of bourbon the other night and recalled one time our monitoring alerted us that one of our remote devices was flapping. We noticed a ton of traffic on our interfaces coming from the third party. We called them up immediately and let them know what was happening. We jumped on a conference call together and found out the third party was getting DDoS'd.

Do you have any "welp, I guess I'm joining this cyberwar" moment?



How does the one IP address request go through so many different servers?

So my question is when you want to connect to a website say google, you send a request to go to that IP address but along the way the packet goes through multiple other routers / servers before actually reaching the destination. How does the router know which servers to hop from one to another when there's only one IP request?



ASAv hairpin and acl filtering

Hi everyone,

I am trying to achieve the setup below. Activate hairpinning in Cisco ASAv and apply some acl's to filter it so that some traffic to be able to enter and exit the same interface while some other traffic not.

Up until now acl's aren't working when hairpinning is enabled. They are simply ignored. We have applied the acl's to specific interfaces, enabled them globally and so forth (every combination).

We test it by sending an icmp packet (ping) from one host to the other. Packet-tracer shows that it should be DROPed, but when testing the packet goes through without any trouble. The acl to drop the icmp packet has been put in place and tested multiple times.

Do you know if this is actually possible or not? If yes, please give us some direction.



Configuring VRRP on HP Procurve 5400zl - is it that easy?

I'd like to setup VRRP on a set of switches I have and they're in production. The switch IPs are currently set to .1 and .2. Do I need to change the currently configured switch IPs to enable VRRP VIP? From HP's documentation it doesn't seem like I need to, which almost seems too convenient.

Configure the router's real IP address for the current VLAN interface as the VIP for the VR instance.

virtual-ip-address ipaddr

https://techhub.hpe.com/eginfolib/networking/docs/switches/K-KA-KB/15-18/5998-8164_mrg/content/ch14s19.html

I'm going to try it out on a test VLAN to see what it does.

Is there any good way to test this without pulling plugs?



Routing FlexVPN (aka DMVPN) loopback through another router when tunnels are down

Hi all

I have a FlexVPN setup with 2x WAN routers in a branch (let's call them R1 and R2) connected to 2x hubs (HUB1 and HUB2)

R1 and R2 have a single ISP line each

Hub 1 Loopback = 1.1.1.1Hub 2 Loopback = 1.1.1.2R1 Loopback = 2.1.1.1R2 Loopback = 2.1.1.2R1/R2 local LAN = 192.168.1.0/24 (interface VLAN10)

I'm using iBGP on the FlexVPN and OSPF on the LAN

Routing configuration:

R1 routing configuration: router ospf 1 passive-interface default no passive-interface Vlan10 network 2.1.1.1 0.0.0.0 area 1 network 192.168.1.0 0.0.0.255 area 1 router bgp 65100 bgp log-neighbor-changes network 192.168.1.0 mask 255.255.255.0 network 2.1.1.1 mask 255.255.255.255 timers bgp 15 30 redistribute ospf 1 neighbor 1.1.1.1 remote-as 65100 neighbor 1.1.1.1 fall-over neighbor 1.1.1.1 next-hop-self neighbor 1.1.1.2 remote-as 65100 neighbor 1.1.1.2 fall-over neighbor 1.1.1.2 next-hop-self R2 routing configuration: router ospf 1 passive-interface default no passive-interface Vlan10 network 2.1.1.2 0.0.0.0 area 1 network 192.168.1.0 0.0.0.255 area 1 router bgp 65100 bgp log-neighbor-changes network 192.168.1.0 mask 255.255.255.0 network 2.1.1.2 mask 255.255.255.255 timers bgp 15 30 redistribute ospf 1 neighbor 1.1.1.1 remote-as 65100 neighbor 1.1.1.1 fall-over neighbor 1.1.1.1 next-hop-self neighbor 1.1.1.2 remote-as 65100 neighbor 1.1.1.2 fall-over neighbor 1.1.1.2 next-hop-self 

The problem I have is that when the tunnel on either R1 or R2 goes down, the loopback IP of the downed router is in the routing table but it's not accessible from the rest of the network - I believe this is because the down router doesn't know the route back to the rest of the network

For example if R2 is down, I can add a static route to R2, which fixed the problem (obviously not a practical solution)

ip route 0.0.0.0 0.0.0.0 2.1.1.1

I tried using the following commands:

router ospf 1

redistribute bgp 65100 subnets

router bgp 65100

bgp redistribute-internal

This does work but has 2 problems - it's a bit of a dangerous feature and secondly what happened is that when R2 ISP is back up, the routes received through OSPF have a lower metric than BGP (110 for OSPF routes and 200 for iBGP), and I couldnt find a way to manipulate that,

Does anyone have an idea how I can get this working?

From the user perspective hte loopback not being accessible causes no problems but in the situation like an ISP IP needs changing or something, it's really awkward to have to SSH from another router on site / console in to fix the problem

Hope this makes sense



Firewall upgrade needed

I currently run an SRX240 pair (I use VRRP rather than cluster) for my firewall in front of about 10 servers for various websites.

I have a 100Mbps port so bandwidth isn't huge (may upgrade to 1gbps this year if the need come up).

I'm looking to replace the firewall, was looking at the SRX340 as I love the commit confirm approach of Juniper and I can pretty much copy / paste the config over.

I've inherited this from my predecessor and there's nothing "clever" on there, just firewall and NAT for IPv4, no IDP / IPS or anything like that.

Should I look at the IDP / IPS features for my next firewall? I feel like I'm torn between Fortinet (I have no experience of these) and Juniper SRX340.

If you could choose, what would you go for?



Affordable 10 gbe router recommendation?

Hey all!

Excuse my ignorance here if what I'm wanting doesn't make sense or isn't available.

I have recently got my first job out of school. I'm the only person in the IT department at my company. We are going to be moving buildings in June and are looking to aquire our own network gear (to date we have been using Comcast's managed router service...). We are a video production company with super high network traffic simply bc of the large files we are uploading and downloading from various ftp servers.

We will have dedicated fiber at the new place and I am looking into a reasonably priced router that can take advantage of that speed. We have less than 20 people on the network so I can't justify a $10,000 router. I'd like to stay under $1000 if that's possible.

Any suggestions would be much appreciated. I'm also interested in any decent firewall suggestions as a bonus.

Thanks!



draytek 2860n stuck at tftp mode after firmware update.

Hello,

I flashed the correct firmware for my router but it got stuck at the tftp mode. It can ping from cmd but it will bootloop.Any ideas?



PCAP to IPFIX?

I am looking to "translate" pcap files to ipfix. I am currently collecting local packets with tcpdump and export them to pcap, however I am looking to examine the IPFIX flows equivalents of the pcap.
Is there any other way to capture local flows in IPFIX?



L3 Routing in Open vswitch

I want L3 routing in an Open vswitch along with some custom rules. What would be the best way to achieve this?

NOTE: I tried using the method specified here https://groups.geni.net/geni/wiki/HowTo/ConfigureOVSWithLayer3Routing . It talks about setting up a virtual bridge for each interface of the switch and then directing traffic from the hosts to the LOCAL port of each bridge, following which Linux kernel routing would do the rest. However, when I followed the steps in a mininet environment, the hosts were able to ping the switch but not the other hosts. What could be wrong with here?



Sophos xg Vs chromebooks

Hello! We have a new xg utm, we also have a few Chromebooks, we want the chromebooks to be presented with their normal login to g suite prompt, then drop to a captive portal due to them not auth'ing on the domain. We can put exceptions in to do this, but the exceptions are to broad and open up lots of sites.google.com/sites/ sites which students are then using to access games (we're a high school), does anyone know the accurate narrowed down exceptions for us to achieve this?

Thanks!!!



Tuesday, February 9, 2021

BGP (1M routes and beyond) Hardware/Software recommendations (sensible at scale!) -- and a little rant about IPInfusion OcNOS

First, I apologize for any reddit rules I should know. I've done a search on this topic here and don't believe I'm violating anything with the question or am ill-prepared on easily-googled answers. Thanks in advance!

The Internet is quickly closing in on 1M IPv4 routes and is already over 100K IPv6 routes (~200K IPv4 slots) which means a lot of 1M and 1.3M platforms are going to be trash. We used to use Cisco 6500/3BXLs and briefly flirted with Sup2Ts but found (the hard way) that their TCAM usage does not scale predictably or really ever achieve their data sheet specs. They make a tiny note of this in the release docs, but ... well, you only find that out after you've migrated the whole network over.

So hey, there is all this wild and crazy new Open Source Hardware and Open Source Networking Software....

We were very excited about the massive routing potential of the Broadcom Qumran w/ extended TCAM and bought a few chassises and had to go with IPInFusion OcNOS because of MPLS support.

At first, IPI was very friendly if a bit slow at addressing bugs and things. They had promised that they had a lot of experience with large BGP views from multiple SPs, etc, but it quickly became apparent that a fully-meshed BGP network of routers with many full and partial peers and IPv4/IPv6 dual stack was beyond their experience. Ok, no big deal -- we knew what we were getting into, a little hair of the dog.

However, we have been informed that they no longer even have a plan to support BGP over tunnel... which kind of kills any hope of fully-meshed BGP networking over anything that a single data center. So much for being an up & coming option vs Cisco or Juniper.

The hardware from Broadcom (via Dell and Edgecore) is fantastic though.

One way to work around the limits of OcNOS... if one were to consider that an option, would be to put a L2 or L2 + tunneling platform or a non-fancy but fast L3 platform in front of the inter-facility connections and run tunnels or VXLans or MPLS Pseudowires to allow them to think they are directly connected even if they aren't. [Option 1]

Another option would be to throw them out and replace them with a single platform that has "reasonable" features. I think those include OSPFv2/OSPFv3 including full IPv4/IPv6 full stack capabilities], MPLS (including over OSPF), BFD, BGP (over 2M IPv4 routes or equivalent), some kind of tunneling between platforms (can be GRE, MPLS, Psuedowire, IPSec, whatever) will allow BGP to take a packet in and send it on to its exit router without worrying about the intervening hops, wire-speed 10G/40G/100G. [Option 2]

In 2021, I don't know that this is a crazy needs list or anything. Openswitch would be great if someone validated its MPLS support (I see a patch at the end of 2019 for L2 MPLS tunnels, but nothing much after that).

Having used Cisco for so long, the first idea was to go to the Cisco version of the Qumran chipset [aka the NCS] -- but the licensing/entitlement structure based on what I've read on the Cisco website is far from clear... it looks like you have to enable groups of 100G at a time, and then there are other features and other licenses that may need to be added. Utilizing a vendor or a Cisco rep for a small order is such a PIA, I'm here to avoid that pain and 3 week exercise to get bad answers. If this is a viable option, I'm sure someone has experience with it. The NCS does NOT seem to be well received and people seem to just go with the ASRs. I don't know which ASRs to look at. I'd like to pick up a couple of platforms on Ebay to test and prove out in the real world before getting burned again.

There is more I could talk about in terms of research into platforms, but I'm hoping someone will give me a quick spiritual kick to the head and point me in the right direction.

Is there a great platform that has sensible units on Ebay I can try out for this set of needs (equivalent to what the 6500 represented in its heyday -- just worked, maybe a few quirks, but rock solid after that) -- from anyone, Cisco/Juniper or even like an Arista or [long list of names that say they do BGP]

Is an open(er) soluton like Exaware an option?

Is there a dumb platform that would meet the requirements of Option 1 and we just do a two-layer solution?

Spiritual kicks welcome, thank you for your time!



What's your dream enterprise network switch/router?

If you had an opportunity to build your dream network switch or router, what would it be like?

GO....



QOS rookie problem

Wondering if any QOS guru's can confirm the correct fix to my config...I feel like I am almost there, but really want to nail it. They kind of let me loose on this to test my chops, as normally this would fall to a more senior admin. I am not a total rookie, just passed my ENCOR exam, but still kinda green. This router is in production!, serving about 500-800 clients.

This is on an edge 4k router chopping up some bandwidth between a couple of static IP's (aaaaa and bbbbb) and 3 subnets from downstream that are natted at the router.

The static IP's seem to be working as intended. A separate access-list for each ip, corresponding to separate class-maps. These classes are applied to a policy-map outbound on the internet-facing interface, as well as the downstream subinterface that they are both using.

For the 3 subnets, they are each on their own subinterface. They are all meant to share a slice of the pipe. I have an access-list that matches this traffic and corresponds to a class-map which I appllied outbound on the 3 downstream subinterfaces. Clients download speeds have reflected that this was successful. I also appllied this class to the outbound policy-map on the internet-facing router interface.

This is the one gaping hole in my plan. I did not take in to account that these subnets are being translated at the router, and nothing was matching my access-list in the upstream direction.

The NAT is garden variety. I have a standard access-list 1 that matches these 3 /24 subnets, and doing overload on the internet-facing interface. I confirmed that they were all using that interfaces ip address as the inside global.

So if I create an access-list that matches on this inside global address, apply this to a class-map, and add this class to the policy-map applied outbound on the internet facing interface...that should capture all of these 3 subnets that have been natted??? Or should I be looking in to the "class class-default" avenue?

Please Help!



What if we used avian carriers(pigeons) as our data transmission method ?

It's kinda funny to find out theirs RFC on this subject

https://tools.ietf.org/html/rfc1149



A few questions from someone entry level.

Hello, I will be fast as I know it's annoying to get the same questions over and over. I have done some research but am struggling with finding what I need. I will also include a couple misc questions while I'm here.

AS in Computer Networking (have not received CCNA).

So I'd like to make a lab network in VMware Workstation 15. I have no idea where to start, so I've been just thinking about how to get a router/switch set up. I realize that I have no idea how to download the cisco CLI onto a device. I have never actually done that step. When I google it I just get people asking questions about VWs and Cisco but not the answer to this question.

My misc concern is: as a newb (2 years help desk, 2 years as part of an operations center that really isn't very specialized thus not great experience), I am just now looking for jobs. I only have received one response back after a week, but it seemed like a perfect move for me (It was a NOC) and I have everything but actually getting my CCNA, though I've done the course work and ICND1 and 2. I got a "no". I'm realizing that I don't know much of anything and feel like my degree is pointless, which is why I am trying to get a lab going to get ready to take my CCNA. I just feel lost and like 4 years into my career I am still entry level.



Troubleshooting low power input at PSU

Hi guys, I'm having an issue with a PSU module, it's indicating low power input, how can I troubleshoot this issue ?

thank you



NXOS on Nexus 9500 might be the worst OS

Im working on some config conversion and I am.amazed at how few features NXOS offers versus the super duper old IOS 12. CoPP doesn't work correctly. uRPF only works on two linecards. Dell Enterprise OS has better security functionality than NXOS. Is this still Cisco's "best" platform for DCs? If so I can see why Arista is slaying them.



Block External SSH Connections

I am looking for the most efficient way to block all incoming ssh connections to my internal network using a palo alto running 8.1.10 software. I noticed today that there is a lot of attempts to connect to one of our servers from a wide range of other countries. It seems like a brute force attack. We have a vulnerability policy setup to prevent large amounts of connection attempts, but I don't have any systems that need external ssh access from anyone who doesn't have access to our global protect VPN, so I would like to shut it down completely. I am just not sure what the best approach is.



SSH Attempts Bypassing Firewall Filter

Hello Everyone,

We have seven Juniper EX-3300s set up in a virtual chassis at my workplace. All switches are running JunOS 15.1R6.7.

Recently we have noticed a slew of failed SSH attempts even though we have some rules in place to prevent this, namely denying root-login of the ssh service, as well as creating a firewall filter that is applied to the lo0 interface:

services {

ssh {

root-login deny;

protocol-version v2;

client-alive-count-max 3;

client-alive-interval 120;

----

filter admin-access {

term 1 {

from {

source-prefix-list {

admin-access;

}

destination-prefix-list {

localhost;

}

protocol tcp;

destination-port ssh;

}

then accept;

}

term block_others {

from {

protocol tcp;

destination-port ssh;

}

then {

discard;

----

lo0 {

unit 0 {

family inet {

filter {

input admin-access;

}

address [redacted] {

primary;

preferred;

}

address 127.0.0.1/32;

}

family inet6 {

address [redacted];

----

Error log:

Feb 9 23:40:26 isp-vc.lax01 sshd: rad_send_request: No valid RADIUS responses received

Feb 9 23:40:26 isp-vc.lax01 sshd: SSHD_LOGIN_FAILED: Login failed for user 'root' from host '119.45.184.216'

Feb 9 23:40:26 isp-vc.lax01 sshd[27055]: Failed password for root from 119.45.184.216 port 49540 ssh2

Feb 9 23:40:26 isp-vc.lax01 sshd[27055]: Received disconnect from 119.45.184.216: 11: Bye Bye [preauth]

Feb 9 23:40:26 isp-vc.lax01 sshd[27055]: Disconnected from 119.45.184.216 [preauth]

Feb 9 23:42:58 isp-vc.lax01 sshd: rad_send_request: No valid RADIUS responses received

Feb 9 23:42:58 isp-vc.lax01 sshd: SSHD_LOGIN_FAILED: Login failed for user 'health' from host '49.235.107.161'

Feb 9 23:42:58 isp-vc.lax01 sshd[27065]: Failed password for health from 49.235.107.161 port 45112 ssh2

Feb 9 23:42:58 isp-vc.lax01 sshd[27065]: Received disconnect from 49.235.107.161: 11: Bye Bye [preauth]

Feb 9 23:42:58 isp-vc.lax01 sshd[27065]: Disconnected from 49.235.107.161 [preauth]

Feb 9 23:45:22 isp-vc.lax01 sshd: SSHD_LOGIN_FAILED: Login failed for user 'root' from host '51.15.118.15'

Feb 9 23:45:23 isp-vc.lax01 sshd[27079]: Failed password for root from 51.15.118.15 port 59164 ssh2

Feb 9 23:45:23 isp-vc.lax01 sshd[27079]: Received disconnect from 51.15.118.15: 11: Bye Bye [preauth]

Feb 9 23:45:23 isp-vc.lax01 sshd[27079]: Disconnected from 51.15.118.15 [preauth]

----

Even with these rules up, we are still seeing SSH attempts come through--even as the user root! I've spent nearly the entire day trying to figure out how these attempts are still getting through. Anybody have any input regarding this issue?



Rant Wednesday!

It's Wednesday! Time to get that crap that's been bugging you off your chest! In the interests of spicing things up a bit around here, we're going to try out a Rant Wednesday thread for you all to vent your frustrations. Feel free to vent about vendors, co-workers, price of scotch or anything else network related.

There is no guiding question to help stir up some rage-feels, feel free to fire at will, ranting about anything and everything that's been pissing you off or getting on your nerves!

Note: This post is created at 00:00 UTC. It may not be Wednesday where you are in the world, no need to comment on it.



New Firewall With 10gbps And IDS and IPS

Hello everyone,

I’ve been asked for a firewall recommendation with the following requirements.

10gbps Throughput using SFP+ Intrusion Detection and Prevention Capabilities

I found that either the Juniper Netscreen 5200 or 5400 might be able to handle all this however they are incredibly expensive and require software licensing.

Are there any other more economical options that can meet 10gb throughput speeds with these requirements?

I found the Juniper SRX1500 but that might only do up to 3gbps. Also requires expensive software licensing.



Can't figure out why VPN keeps dropping

Hello all,

Cisco VPN dropping issues with remote workers. Can't figure out what's causing the problem. It's intermittent with end users. Changing routers out seems to be working for some but not others. I'm starting to wonder if the MTU size is causing an issue on some routers but not others?

Anyone else see this? VPN will drop every 20 minutes or so.



Replacing Cisco 5525 with ?

I'm looking at replacing our current 5525 with something else later this year. I like everything I've read on Fortigate firewalls but not sure where to start. We have a 100mb internet connection with about 250 users and 4 site to site VPN connections. I would need the new firewall to have at-least 10 rj-45 ports for a few different DMZs that we have setup. One thing I would like is GEO-IP blocking. If that's still a thing as we only work within the US.

Client VPN and content filtering isn't really important because we have other appliances that take care of that. I would like some type of IPS/IDS technology even if it requires extra licensing. I've heard Firepower is horrible which is one of the reasons im thinking of moving away from Cisco. I also feel like you don't get as much for your money with Cisco Firewalls. If the price is right I would love to have 2 setup in high availability. We run a 24/7 operation but IT is only 8-5pm so the thought of a single point of failure is always in the back of my mind.



100 Gig BiDi Constant link flap.

Hey Guys : ).

We are currently in the process of creating 100gbit connections between our datacenters, which is less than 2km in between.

When i was configuring this, i also saw that the link flapped a lot with only a 3m fiber cable, and i was able to make the link flap by just moving the fiber cable around. The cable is a complete standard splitted Singlemode OM3 cable (Sorry i don't know much about cables, so i'm not 100% certain).

We have now moved the switches and installed them in racks on both our sites and tested the connection, the link does get up and negotiates a 100gig but ofc. flaps a lot. Like several times each hour.

The SFP modules is Flexoptix 100G QSFP28 BIDI CWDM4 WITH DUAL CDR (They are programmed for compatibility with HPE products). These were the only ones we could find who could do 100gbit BiDi on a 2KM distance for HP(E) equipment.
The switches are HPE FF 5945 48SFP28 8QSFP28.
I know pretty much nothing about hardware and i'm usually just pulled in when there's already data on the wire.

So my question is.. Do i need a high quality fiber cable running from the Fiber patch panel or do any of you have another theory maybe ?

Thanks guys ^^.



Cisco Call Manager & Analog Phone Adapters

Does anyone know of a analog adapter, other than ATA 190/191 that works with Cisco Call Manager? Preferably something not Cisco.



Move to a stack?

I have three campus sites linked by fiber. Right now they are on a single link, but in the near future they will share three links of different speeds, one 500 Mbps and two Gb, that will come in at each site. Right now the network are distributed over functional but obsolescent SG300 switches, each of which is configured individually.

Ideally, I'd like to stack the distributed switches and have multichassis etherchannel among the three sites and possibly over two additional 10-port access switches.

My research so far suggests that the affordable and familiar route may be the old Cisco 3850 series, probably the 24T-L so that the uplinks can be 10 Gb modules.

Is this a practicable direction? The budget is <$3000, not much, so it may be that we have to settle for what we've got. The new gear is both too capable and unaffordable for our application.



Data Center 208v network compatibility

We have a data center with 120v and 208v circuits. Most of the networking equipment is plugged into the 120v but the 120v is being over-utilized. I can plug the Cisco gear into the 208v without issues? Would be an ASA, a couple of routers, and nexus 9k switches. If something is rated up to 240v I assume 208v would also be fine? Electrical stuff is not my strong point I admit. I would also most likely need a c13 adapter for the 208v pdu?



Cisco C9800-40 (WLC) routing capabilities

Hello networkers,

does any of you have some experience with routing on cisco WLC catalyst 9800? I mean make SVIs on C9800 default gateways for WLANs and use Layer 3 routed link to the Core switch.

Thank you, for any feedback.



What do you put in your sysLocation field for your networking equipment? City and State? Sitename? Building number & room number? Blank?

I'm curious how people use the sysLocation field in their network. Is it just a scratch note to enter a brief location description (ie: You have no set format), or do you have a specific field definition that you use it for organizing groups of devices (Room, Bldg, Sitename).



Folder/Printer Sharing Over WAN (I want only on VLAN)

When doing network discovery, all computers appear from across the WAN, which should only showing PC/printer from the same VLAN. I can't block ports 139 and 445 because they are needed for access to the domain controller. What should I do to solve the problem?



NETCONF and GNS3

Greetings! I am working on a Python and NETCONF project using GNS3 and I can't seem to find any information on how to get this topology running.

First of all, here's the basic topology: https://i.imgur.com/cl1RDdz.png. The CSRv is running NETCONF fine and, it will be used to throw some basic commands like PING, traceroute, etc. The Ubuntu Docker basically runs the python scripts I made. Every device shown is reachable without any trouble and the topology is running on the GNS3-VM on a ESXi host.

The problem is that since NETCONF uses port 830 to establish connections, I've been trying to open it on the GNS3-VM with multiple commands but, none them did the trick.

What do you guys recommend?

Thanks in advance for the time!



Sonicwall TZ400 loss of connectivity ~4-5 mins every few days

We have a Sonicwall TZ400 that was inherited we monitor. Every few days at around 2-3am we lose connectivity to the site. I have turned off auto-updates but there still is configuration backups that happen right after these losses of connectivity around 5am.

Is there a way to stop this from happening?



Explain ASA Syslog Syntax

Hello,

Was hoping someone could assist me with a break down of the following syslog event line coming from my ASA:

%ASA-0-106100: access-list Global denied tcp L2_***/*.*.*.*(502) -> L2_**/*.*.*.*(63374) hit-cnt 30 300-second interval [0x905fd385, 0x00000000]

I filtered out my IPs for privacy but just looking for an explanation, especially in bold. Also this is saying something was blocked correct from port 502 to port 63374. Where is the rule references that is actually blocking? and again an explanation of what is in bold... is this block because of a certain amount of hits in a time interval?

Thanks!



Who has access to your monitoring?

As we rebuild our Solarwinds implementation (thank you Sunburst!), I was auditing our accounts when I realized I was scrolling through 7 pages of AD groups with different levels of access. Many of the users in the groups have never logged in, despite my supervisor's insistence that we give them access. What's worse, the folks who are supposed to use Solarwinds aren't logging in either - they just ask the network team for what they need on MS Teams instead of looking it up themselves.

I'm curious, how common is this? Do you let other folks view your monitoring data? Do they?



IPv6 understanding....with an edgerouter

Please forgive my lack of understanding of IPv6.

I'm (finally) migrating to an ISP that natively supports IPv6. This is Zen in the UK. They provide an ND /64 prefix and a PD /48.

Now here's where my lack of understanding comes in....or perhaps I'm comparing it incorrectly to IPv4.

What's the difference between the ND and PD in (semi) laymans terms? Is the PD allocation accessible from the internet? If so, why should I use the PD over the ND range?

I'd like to distribute IP ranges across my virtual networks on my Edgerouter, which is set up as follows:

eth0 -> PPPOE
eth1 -> a server that runs various stuff, plex, http, etc (no vlan)
eth2 -> a switch that has some work devices (on a vlan)
eth3 -> not used
eth4 -> a Unifi AP that also has various networks utilising VLANs

Currently it's a pretty standard static IPV4, NAT, and then VLANs for the various stuff.

Do I need to have the PPPOE take an IP from the ND range, then allocate PD ranges to the VLANs above and utilise DHCP to assign IPs to devices?

Or can I just manually assign ranges from the ND /64 to PPPOE and all the VLANs and not use the PD block at all?

I'm totally new to all this IPV6 stuff....help!



Velocloud SD-WAN 620 VMWARE - DHCP IP reservation

Hi,

I have to replace Mikrotik router that has a few configuration configured.

  • Subinterface for two vlan... ok
  • Two static route... ok
  • DHCP server... naaah, partially ok.

I can not find option to configure several IP addresses bound to specific MAC address (IP reservation) in LAN segment (Phones, printers and few specific hosts)

Does anyone know how to accomplish this?



Monday, February 8, 2021

Can someone explain the difference between OFDMA and OFDM?

In OFDM, I understand that the sub-carriers can be located closer to each other than in regular FDM by ensuring that the "peaks" of each sub-carrier aligns with the "zeroes" of their neighbouring subcarriers.

However, for the life of me I just cant find any good videos that can explain what OFDMA actually is. It seems like it has sthg to do with a user being able to be allocated "blocks" of sub-carriers of different bandwidths depending on how much they require?



Juniper interface alarms after being disabled

Disabled an interface on a juniper router but its still output "Digital Optical Monitor" alarms for that interface? Any idea why or how to stop it?



Nornir folks - released nornir-salt documentation

Hope this would of good use to anybody:

https://nornir-salt.readthedocs.io/en/latest/

Edit:

nornir-salt is a collection of plugins and functions that can be used with Nornir. Some of the plugins (presumably) solve common problems people having while using Nornir.

For instance RetryRunner can execute tasks and retry on failure, have support to connect with devices behind jumpboxes and capable of helping with overloaded AAA system by not running too many connections at the same time.



IPSG - Static Entry Question

I discovered something when trying to convert 3750 config to 9300 syntax and I'm wondering if the 3750s never worked quite right or it was just not fully understood. If anyone can test, I'd appreciate it

So we have DAI and IPSG enabled. DAI is working using:

ip arp inspection vlan [#] ip arp inspection log-buffer entries 1024 ip arp inspection log-buffer logs 15 interval 5 ip arp inspection filter [ACL_NAME] vlan [#] 

Static IP addresses require a static entry using:

arp access-list [ACL_NAME] permit ip host [IP] mac host [MAC] 

This is working fine; when enabled a static IP address won't work until the entry is added to the ARP ACL. However, things work fine when it comes to IPSG and no static ip source binding

Global Config:

ip dhcp snooping vlan [#] no ip dhcp snooping information option ip dhcp snooping database [Location] ip dhcp snooping ip device tracking probe interval 90 ip device tracking probe auto-source override ip device tracking probe delay 10 

Interface Config:

interface GigabitEthernet[#] switchport access vlan [#] switchport mode access switchport nonegotiate switchport port-security maximum 2 switchport port-security maximum 1 vlan access switchport port-security violation shutdown vlan switchport port-security aging time 2 switchport port-security aging type inactivity switchport port-security ip device tracking maximum 2 power inline never power inline police action log priority-queue out no cdp enable storm-control broadcast level pps 500 350 storm-control action shutdown storm-control action trap spanning-tree portfast edge service-policy input [Policy_Name] ip verify source tracking ip dhcp snooping limit rate 100 end 

This seemingly should require the following statement to work:

ip source binding [MAC] vlan [#] [IP] interface Gi[#] 

And that's what was there. I removed it and pings stopped. But then I bounced the port and it began working again

I'm thinking this must not be required based on the verbiage in the following link:

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/15-2_4_e/configurationguide/b_1524e_consolidated_3750x_3560x_cg/b_1524e_consolidated_3750x_3560x_cg_chapter_0100010.html?bookSearch=true#task_1267082

IPSG for static hosts allows IPSG to work without DHCP. IPSG for static hosts relies on IP device tracking-table entries to install port ACLs. The switch creates static entries based on ARP requests or other IP packets to maintain the list of valid hosts for a given port. You can also specify the number of hosts allowed to send traffic to a given port. This is equivalent to port security at Layer 3.

I do have an entry when looking at the device tracking table

----------------------------------------------------------------------------------------------- IP Address MAC Address Vlan Interface Probe-Timeout State Source ----------------------------------------------------------------------------------------------- [IP] [MAC] [VLAN] GigabitEthernet[#] 90 ACTIVE ARP 

The config guides and blogs I see all mention the static binding. I get that, and it makes sense, yet works without it. Can anyone test this and see if you get the same results? I don't think I'm missing anything but perhaps I am. I noticed on the 9300s things working before I got a chance to add the static entry and this is how it came to my attention. I do have a TAC case but so far no answer

Any thoughts?

TIA