Stupid question and an EIL5 but what is the difference between PVID and an untagged vlan port?

I've read up on them but I've just started getting an understanding of how VLANS work. I understand untagged and tagged but what exactly is the difference between a PVID and an untagged vlan?

Question How to handle Multiple Site to Site Vpns

I'm currently having issues with handling multiple sites to site VPNs with my current firewall Sophos XG all these tunnels are IPsec based so was wondering what you gents use to handle your tunnels. I'm currently looking at building FreeBSD machine to make that it my IPSec VPN Concentrator. Most of the tunnels we have are to our client sites so that we can hop on to the network and monitor things. Thanks in advanced.

Datacenter Wan ports? where exactly should they be plugged in?

Recently someone posted a question asking if a WAN port should be plugged directly into a switch, suggesting it could be a security risk and open the network up to DDOS attacks.

I'm curious what others have to say? At my last company we had 2 routers going into the wan connection (only because we had our own /24 ip space we were advertising to the carrier) and then both of these routers went into an 'outside' VLAN on our switch.

Current company - providers at main datacenter and DR site are giving us a default route. Our DR site has the WAN link going directly into the outside of our firewall. Our primary site has 2 ASAs in an HA config. We have an untrust VDC (Nexus 7K) within which is an 'untrust/outside' VLAN. The link with the ISP goes into a port on the untrust VLAN. In this VLAN we also have both ASAs, the primary and standby. We also have another ASA in this VLAN servicing the remote Cisco phones since we don't have MRA yet.

I'm curious what others' thoughts are and how else would we achieve the same result without plugging the WAN link into the switch? I suppose we could a router in front and then have some of the router links go into the outside VLAN?

TP Link WR741ND. Same IP address on WAN and Gateway.

So my ISP gave me TP link WR741ND and when I try to connect to Internet it gets same IP address for both WAN interface and WAN gateway over PPPOE. And network mask is 255.255.255.255. Is that ok? Internet is not working.

MAC move log confusion Cisco 9k

I am seeing some logs on our Cisco 9k that look like this:

Feb 12 09:40:08 vwn9k : 2018 Feb 12 09:39:39 CST: %L2FM-4-L2FM_MAC_MOVE2: Mac 48df.3720.9ecc in vlan 106 has moved between Po15 to Eth1/2

Po15 is the uplink port for the switch. Eth1/2 is where the device is physically connected. My question is, is this normal behavior? I know that the mac address has to be advertised on the uplink port, and it obviously will be shown on the individual interface. So is it normal to see these logs? Thanks!

Juniper SRX NAT question

hi all,

I've tried to google it a blittle but I wasn't able to find answer to this one. I've tried to configure it via Junos Space using my own logic but without success so I'm probably missing something or it's not technically possible.

Scenario is following: Juniper SRX300 cluster sits on the border with internet . It has inside interface (trust = 10.1.1.1) and outside interface (untrust). Untrust side knows routing back to my private subnets behind trust.

I would like to use firewall's inside address as NAT address. in other words whenever I send traffic with destination of i.e. "10.1.1.1:1111" I would like the firewall to translate the IP address and the port (to i.e. 8.8.8.8:80) and send it by the routing/policy to the untrust.

Technically I don't see any showstopper but apparently my SRX thinks that anything destined to his inside address should be handled by Control/Management plane and not by Data plane. Thus telnet to 10.1.1.1:1111 fails for me. Anything I'm missing?

Delayed Packets - WireShark Visual Representation

We have an ongoing network performance issue with a 3rd party and there is some disagreement as to where the source of these delays are coming from.

What I'd ideally like as a manager is to cut through the technical aspects of the capture and see a visual representation of a conversations.

ServerY >>1ms>> Router1 >> 40ms >> End-User Device

and then the reverse conversation back. Is there a tool out there that can do this?

multicast when service provider does not support over mpls

We have a mpls network provided by our service provider. There is a requirement to have multicast between our remote sites, however our SP does not support multicast over the mpls. What creative options exist for us to tunnel multicast traffic over the mpls? This is a cisco network. IF the SP did provide multicast how would they be typically be doing it? mLDP?

Network discovery, what application are you using?

Many of us here work as consultants deployed onto customers networks to add equipment, solve an issue or advise on possible changes that could be made to improve the customers networks.

There is such a wide range of tools for network discovery these days, I have been using Advanced IP Scanner for a while that produces basic IP, hostname and service reports, and Nmap when I need a little more info.

But my question to /r/networking is.

You have been given permission onto a customers network, you sit down, plug in,

What is the first application you open to start your network discovery & reporting?

(And can it do SNMP info as well?)

Basic query on VLANS and IPHELPERS.

Hi All,

Have a layer 3 switch with VLAN 100 on it (for example) which has an IPHELPER pointing to the firewall for DHCP. Plugging a device into a port untagged on VLAN 100 gives me a DHCP address and all is happy with the world!

I want to connect a L2 switch to the L3 switch to add some more ports etc.

Will a device plugged into an access port in VLAN 100 on the L2 switch still get DHCP address by the fact the L3 switch has the IPHELPER on it? Or does the IPHELPER need to also be present on the switch the device is plugged into?