Cisco Selective Packet Discard (SPD) and Input Queue mismatch

From what I can tell the SPD is supposed to be the lowest input queue size found on any interface on the router. So does that mean that the packet goes through the interface's input queue before the final route processor input queue? Or is the SPD input queue added onto the interface's input queue?

​

I ask because If I log into a router I see a default input queue MAX of 375, but if I run "show ip spd" I see the max is 75. So how do they work together?

​

EDIT:

​

here are some facts I've gathered

​

The SPD headroom is shared by all interfaces

SPD devides the queue to the route processor into a general packet queue and priority queue. The general packet queue is a global one. Both of these facts from "BGP design and implementation".

​

This to me suggests the SPD queue comes AFTER the interface input hold queue.

​

Express Route

Hi All,
I have a client that we are migrating to O365.
There is a need to implement "Express Route" https://docs.microsoft.com/…/expr…/expressroute-introduction

Now that is easy to achieve on MS side.

We want to get better performance on ISP side as well and asked them (The ISP) to create a virtual port (Hope this term is correct) and prioritize O365 traffic from that specific customer to MS.

Now,
Either the ISP are clueless, and do not know how to do it, or this is a very new thing for them and they really do not know how to do it.

The solution they want to sell us is a direct 100Mb connection to MS. Which is great but too expensive for us + an overkill of what the client needs. (MS and ISP are in the same PoP)

Anyone have an explanation about how to create a virtual port? Ideally, I would like to provide the ISP a step by step guide on how to create this port so it can be used by my customer.
If not a step by step guide, just explain them how to do it in simple words.

Any suggestions?

Thanks!

Question about RFC6598 (100.64.0.0/10)

I've recently moved to a new apartment complex, and the ISP is using RFC6598 addresses for clients on the wireless, and routing devices through a NAT for internet access.

This appears to be against the RFC, as it appears the intention was to use the address space for "Customer Premises Equipment"; not typical client devices (iPads, Laptops, etc.)

Additionally, the intention of the RFC seems to be to help ISPs continue to provide IPv4 access while deploying IPv6, and yet, the ISP is v4-only.

There's also some security concerns regarding the use of this address space, as many browsers will treat RFC1918 addresses with more security than it would with "Public Addresses", which I assume most browsers would treat 100.64.0.0/10 as.

So, I'm curious what /r/networking thinks about this; is this common practice? Is the ISP doing anything wrong here?

Interested in developing a wireless network to support multiple moving sensors to track relative positioning. Any ideas as to what type of wireless network to use?

First and foremost I do not have an IT or Comp Sci background. Have a BS in Physics, and a Control Systems (PLC) background. Have an idea for something and I'm at a loss as to how to start moving towards developing it. It's going to be something like the programming of a self driving car.

It will be sensors that are moving hence why it needs to be relative positioning between the transmitter/receiver and sensors. Any help narrowing it down between the two or other possible options I'm not looking at. Also I don't have a number for the amount of sensors, but it will be more than 10 and less than 100. Also I think there will be a multiple nodes. Less than 100m range, preferably with high/fair accuracy and low power consumption on sensors. Sensors will continuously connect/disconnect to different nodes as they change distance between one another.

I'm unsure even what types of networks to start with. The research I've done so far is leading me towards, Bluetooth/ZigBee with a mesh look promising. Or what's called a Mobile Ad Hoc Network, or Vehicular Ad Hoc Network.

Also, anyone have any ideas as to how to start diving down the rabbit hole of developing a product that is similar to what I've mentioned? I picked up a copy of Network Warrior to start learning the basics. Just need a direction to go in!

Ping Vs trace

Hey guys, It just turned Monday here and it's been better.

As the topic says, when I ping a gateway from the peered device, there is no loss, even with 15k packets. But, when I trace to any destination, I am seeing strange loss figures on the same gateway device.

The device in question is a Cisco L3 (though I see the same with anything else). Now I'm sure there is a simple logical explanation for it and an easy fix too.

Now when I ping the hop after the gateway with 15k packet size, there is no loss, yet MTR or trace shows loss. Clients are going a little nuts over it and though there are no other complaints from those clients, the loss at the hops are bumming me out

No proxy-arp No IP unreachable No IP redirected 

Those at on the gw interface/svi (if it helps).

Thanks.

Understanding Networking

So while configuring a new learning Network i came up with the following question:

When a new client joins a network, he sends out a Broadcast for "give me IP". DHCP Server gets call, sends information.

But how does he obtain the preferred DNS. Is this given the same time when the DHCP Server gives the client the IP, Subnet and gateway information, or is this another call from the client ?

​

I am learning all about this stuff, because I want to get into this section, so understanding this would be very helpfull :)

Am I able to setup a VPN on my PC for my brother to route through?

My brother is in Louisville, KY and we're looking for a good location spoof workaround so that YoutubeTV recognizes his location as Pittsburgh and he can watch Steelers games. It doesn't look like any VPNs offer Pittsburgh as a server so I was thinking I could set up a VPN with my home network and he can route through that.

Is that possible? Any other options?

What next after CCNP R/S?

I got my CCNP Routing & Switching a few ago and I was wondering, what should I focus on next? Security? Cloud?

Could you guys give me any advice on what courses should I consider?

Thanks in advance.

Looking for BETA Testers and Early Adopters for my SSL management tool

Sorry if this is not the correct subreddit, I hope it is.

Ok, let me give you a little more info about this idea.

1- It is cloud based

2- It will also warn via email, SNMP, and text that certificates need renewing. The tool can even randomly poll via the method used (LDAP, HTTPS, IMAP, etc) and make sure the certificate is good for that server/service.

3- It will be FREE for now.

I have tried looking for solutions for this. Unfortunately, most of the options out there are for enterprise-only environments, and want to only work for Windows/IIS, or only track HTTP. SO I BUILT MY OWN. It still needs more testing

Would love to get some beta tester on it, anyone would be interested?

If you have any questions, you can PM me or comment.

ISSUE: CISCO ISE TACACS + AD authorization every one has read access

hello every one recently i have started using cisco ise as a tacacs server to grant device access using active directory credentionals witch works fine but i have found out the even if a user is in active directory and has not been assigned to the access group it still can login to routers and has read access but no write access, so how can i prevent anyone without the right group accessing network devices.

my router config :

aaa new-model aaa group server tacacs+ ISE server-private 10.1.1.114 key *** cache expiry 8760 cache authorization profile LOGIN-AD-CACHE cache authentication profile LOGIN-AD-CACHE aaa authentication login LOGIN group ISE cache ISE local aaa authentication login CONSOLE local aaa authorization config-commands aaa authorization exec AUTH_EXEC group ISE cache ISE local if-authenticated aaa authorization commands 0 AUTHO-COMMAND group ISE local if-authenticated aaa authorization commands 15 AUTHO-COMMAND group ISE local if-authenticated aaa cache profile LOGIN-AD-CACHE all 

​

​