Why isn't this VLAN interface being added to the routing tables on a Cisco 9300 stack?

I’ve configured VLAN 100 on my soon-to-be core 9300 stack for a routed transit network to my edge firewalls. It’s configured similarly to all of the Access VLANs on the stack:

! interface Vlan100 description EDGE_TRANSIT ip address 10.1.100.101 255.255.255.252 ! 

However the network isn’t showing up in the routing table, and even though the command “ip default-network 10.1.100.102” is in the running-config it’s still not showing up in the routing table as having a gateway of last resort:

Gateway of last resort is not set 10.0.0.0/8 is variably subnetted, 26 subnets, 2 masks C 10.1.12.0/24 is directly connected, Vlan12 L 10.1.12.1/32 is directly connected, Vlan12 C 10.1.13.0/24 is directly connected, Vlan13 L 10.1.13.1/32 is directly connected, Vlan13 C 10.1.14.0/24 is directly connected, Vlan14 L 10.1.14.1/32 is directly connected, Vlan14 C 10.1.15.0/24 is directly connected, Vlan15 L 10.1.15.1/32 is directly connected, Vlan15 C 10.1.16.0/24 is directly connected, Vlan16 L 10.1.16.1/32 is directly connected, Vlan16 C 10.1.17.0/24 is directly connected, Vlan17 L 10.1.17.1/32 is directly connected, Vlan17 C 10.1.18.0/24 is directly connected, Vlan18 L 10.1.18.1/32 is directly connected, Vlan18 C 10.1.19.0/24 is directly connected, Vlan19 L 10.1.19.1/32 is directly connected, Vlan19 C 10.1.20.0/24 is directly connected, Vlan20 L 10.1.20.1/32 is directly connected, Vlan20 C 10.1.28.0/24 is directly connected, Vlan28 L 10.1.28.1/32 is directly connected, Vlan28 C 10.1.60.0/24 is directly connected, Vlan60 L 10.1.60.6/32 is directly connected, Vlan60 C 10.1.70.0/24 is directly connected, Vlan70 L 10.1.70.1/32 is directly connected, Vlan70 C 10.1.200.0/24 is directly connected, Vlan200 L 10.1.200.1/32 is directly connected, Vlan200 

Why isn’t that network for VLAN 100 showing up in the routing table, and why isn’t it taking the default-network command?

2 NAT statements for the same public IP address - fundamental network question

This might be a strange question but let's say I have a webserver that hosts a website.

​

Internally this website is 172.28.250.2 and lets say I have a NAT statement on my firewall to resolve this to some public IP address of 67.x.x.67 for customers to hit from the outside.

​

Let's say the URL to this website is www.abcd.com and now I want to add a second url that goes to this same website as well lets say www.dcab.com ( I guess they would call this an ALIAS in DNS) so they would both go to the same website. Lets also say that these 2 URLs internally resolve to the same IP address of 172.28.250.2 as mentioned above, but the second url has a different public IP address lets say 68.x.x.68

​

Let's say I didnt have access to DNS to make the 2nd one resolve to the same IP address for customers on the outside to hit. As a backup plan, Is their a way that I could make a NAT statement on the ASA to take this new URL outside IP address also NAT against the 172.28.250.2 address. I believe that this is a fundemntal problem since now you probably can't have 2 different outside IPs resolve to the same internal IP...but maybe there is a trick here that I'm not aware of?

Rant Wednesday!

It's Wednesday! Time to get that crap that's been bugging you off your chest! In the interests of spicing things up a bit around here, we're going to try out a Rant Wednesday thread for you all to vent your frustrations. Feel free to vent about vendors, co-workers, price of scotch or anything else network related.

There is no guiding question to help stir up some rage-feels, feel free to fire at will, ranting about anything and everything that's been pissing you off or getting on your nerves!

ASA VPN Issues with default NO ACCESS policy

I have setup an ASA to authenticate to the AD server in conjunction with VPN access. Everything works except for two things:

1. When using assigning a default "NO ACCESS" policy to the AnyConnect Profile, I am unable to access the VPN using an account that has access. Once I change the default policy back to a policy that grants access, I can sign in with out issues.

2. Upon successful connection and access to the VPN, I cannot access any servers or shares on the internal network. Secured routes include the network that the servers are residing on.

I am using the anyconnect fat client downloaded to the laptop that I am testing this out with.

If more information is needed I can provide more but I figure this might be enough to help me figure out where the issue may be.

ISE authorization failing

Hello, I'm new to ISE, working on getting some servers using radius authentication with ISE. I'm able to see the request come into ISE, authentication passes, but then authorization fails and it looks like it hits the DenyAccess authorization profile, and even after adding the device into ISE, setting up radius and setting up a policy set, it still fails. Worked on it all morning reading Cisco guides and such and can't seem to figure it out. Any helper ideas on where to go with this would be greatly appreciative.

Router recommendation for small business?

Right now we have an RV320 and not happy with it.

Mainly because dual-WAN is flaky, and VPN never really works reliably.

​

We got about 20 people at the office and 3-5 remote workers over VPN.

Dual-WAN is a must. WiFi is nice but not requirement. Easy VPN setup would be amazing.

I was looking at ASUS BRT-AC828 but seems to be a bit hard to find and expensive. Is this still one of the best for this purpose?

​

What would you guys recommend?

​

​

In MPLS L3 VPNs + OSPF, why do topologies with sham-links not use the DOWN bit?

Is the reason because the routers have a whole view of the topology and thus are able to prevent routing loops?

Sticky MAC address on one port preventing that computer from connecting on a different port

We have port security enabled on a small handful of ports that are "public" facing (i.e. ports in the lobby that you don't need a key card to reach). Today we had a new person sitting at the front desk for a little while so I increased the maximum number on that port by 1 which allowed her laptop to connect and everything was fine.

When she went back to her normal desk she was unable to fully connect via ethernet. The same switch stack is used for the entire first floor office area which includes the front desk and her own desk. Her laptop was getting a DHCP lease including an IP, gateway, dns, and all that but it was unable to ping any addresses in any subnet (her own or otherwise).

During this time I tested plugging her computer into a port on the 2nd floor, which is a separate switch stack, and it worked fine.

The thing that eventually fixed it was to remove her MAC address sticky entry from the lobby port. I haven't been able to figure out why the issue occurred in the first place though. Has anybody seen this before?

She was the 5th MAC address to be added to the lobby port and the other 4 have not had any issues like this.

​

Switch that supports both OpenFlow and IPFIX?

I have tried to find some vendors that ship switches with both OpenFlow and IPFIX, however, I could not find any.

Specifically, is there any OpenFlow switch that supports IPFIX flow export?

Edit: I reframed my question

Accessing CCTV camera on a dynamic IP

My DVR is connected to the router via an Ethernet cable. However, my ISP does not provide a static IP and blocks all ports

I purchased a VPN service that gives me a static IP. However I am still unable to connect to the DVR. My VPN provider has tried to “force connect” the DVR to VPN using PPTP I am still unable to bypass the blocked ports.

I have an OpenWRT router.

This image illustrates the configuration i have.

I have a raspberry pi that I can use as a device to remotely port my DVR.

ALSO, I am horrible with networking and have absolutely no knowledge so please help me out. I have wasted so much time on this.

Thank you so much.