[help] Cat 9300 IOS version recommendations

HI all,

We have a pair Cat 9300 (advantage licensing) arriving tomorrow to replace a switch in a sort of emergency’s situation. These will the first Cat 9k we had, however once they arrive, I need to configure them into a stack and modify the existing equipment config to apply to these new switches and ship them to site the same day.

One question I have is what is the currently recommended OS version branch? 16.9 or something else? What are people’s recommendations?

Also in regards to smart licensing, do I need to open up the firewall to permit the switch to register, or can I upload a licences file or something to it?

Thanks

Timeline for netowrk installation

Quick question...on average how long would it take to install a network in a small business? The floor plan has approximately 50 offices, looking at using Cat 6a cable, 2x ports in each office (voice/data).

Is there any way to do this without PBR?

Let’s say we have our own ASN, and two public /24’s of our own to advertise out. For the sake of example we’ll just use 1.0.0.0/24 and 2.0.0.0/24.

At our data center we’ll connect to two different ISP’s using our ASN, and advertise both subnets to both ISP’s.

I have been asked to configure the network in order to meet the following requirements.

• Any company owned device that our firewall team NAT’s to a 1.0.0.0/24 address must use Circuit A for all Internet access. Both sending and return traffic from remote endpoints must use Circuit A only.

• Any company owned device that our firewall team NAT’s to a 2.0.0.0/24 address must use Circuit B for all Internet access. Both sending and return traffic from remote endpoints must use Circuit B only.

• In the event that Circuit A or B fails, traffic will fail over to the other circuit and continue to work. So if Circuit A fails, then 1.0.0.0/24 will fail over to Circuit B and share that link with the 2.0.0.0/24 traffic. And vice versa

At first glance I told leadership “I can do this,” and set about designing the bgp stuff with the two providers.

By using AS-PATH prepending, I can in theory make 1.0.0.0/24 preferred to the outside world on Circuit A. I can do the same on Circuit B for the other subnet.

If the prepending is allowed to stand, it should accomplish what Circuit a particular subnet routes to from the outside world, and still allow it to fail over to the other subnet in the event of a circuit outage.

Perfect. Mission accomplished.

There’s only one... little detail I left out. Egress traffic from our network to the Internet.

How can I force traffic arriving at the edge from the firewalls with a source ip in 1.0.0.0/24 out Circuit A and traffic arriving at the edge from the firewalls with a source ip in 2.0.0.0/24 out Circuit B?

Uh oh.

I know one can control egress traffic with tools like LOCAL-PREF, or WEIGHT. But those are destination-based tools. You pick a subnet being advertised to your AS, and assign it a higher LOCAL-PREF coming from either ISP A or B, and your AS will send outbound traffic destined to that subnet to the peer with the higher LOCAL-PREF for example.

There’s only one problem. The endpoints sourcing traffic from either 1.0.0.0/24 and 2.0.0.0/24 all talk to the exact same IP’s out there, almost 1 for 1. So it’s utterly impossible to do any kind of destination based routing to send their egress traffic out the correct circuit.

The only method I can even fathom with my small imagination is a PBR route-map on the interface from the firewall, doing source address based forwarding with verify reachability.

This leaves a very sour taste in my mouth. Because PBR is only meant to solve temporary problems, not to be implemented permenantly in production. This PBR would also touch every packet leaving our network, so performance is a key concern.

How can I accomplish the three specific requirements above without using PBR? There simply must be a way!

Cisco Firewall

I am entirely confused, and online documentation that I found does not really addresses my question.

I have 3 PC on the inside 10.0.0.0/24 I have 1 server on the outside 205.0.0.1/24

How do I build the access-group if I want the inside to be allowed to reach the outside, vice-versa? In what direction and interface do I build the access-group? What’s the logic behind this?

Do I place it on the inside or outside interface And which direction do I sit this on?

access-group INSIDE in interface INSIDE

access-group OUTSIDE out interface OUTSIDE

Each interface has (2) options. Either in or out. How do I know which to select, what logic do you use to help you simplify this logic?

1 server 2 nics 1 ip goes "down"

Basic scenario here I've been brought in as a consultant to help resolve this problem so far it's a head scratcher. There are server and client VLANS, L3 Switch in the middle serving as router. Switch is an HP-5412zl.

There are multiple servers but the one that is serving as primary DNS is what got them to bring me in. The server has a dual onboard nics which are both in use. One of the IP addresses will inexplicably and intermittently go offline. Going offline here means quit responding to ping and DNS is unavailable as well. The other nic stays online. I've already swapped the switch ports that they are attached to and the problem follows the problem nic. When the issue occours unplugging the nic and plugging it back in immediately fixes the issue.

I was leaning towards this being the one nic in the server or possibly the cable causing the switch to shut down the port. However, I started a trace to those IPs with ping plotter from the client VLAN and after I added a different server I found that it was "going offline" at the exact time as the problem NIC on the DNS server. When reseating the original problem nic the second server still remains offline though the interface with the issue comes back online.

I had to leave due to a sick kiddo shortly after this latest discovery so I'll be heading back to the site this week. I'm wondering about looking into the switch and its MAC table and doing a packet capture in the server VLAN to see if the switch is arping around for the MAC. But this issue is just feels very strange.

EDIT: For spelling and clarity

Spaghetti Network

I just got a new position at a school, looking after their network. Looking at their current setup I have noticed their bottleneck but I lack architecting skills so not sure the best way to fix this. Building 1 is where our servers are and building 2 are where the backup servers are.

​

Building 1 fibre | Linked directly
Building 2 fibre | Linked to building 1 and 6
Building 3 fibre | Linked to building 2 and 4
Building 4 fibre | Linked to building 3 and 5
Etc.....

There is no pattern to how they are all connected but I can see for example building 4 the bandwidth has to travel down with all of the building 3 and 2, amazingly it works but slow. We only have 2-3 switches so I will combine core and distribution layers. The plan is to have fully fibre core switch in building 1 (primary) and building 2 (secondary).

No idea how to configure the fibre. I guess I want traffic to default to Building 1. What happens if one VM fails in Building 1 how can it automatically go to building 2 without routing the rest of the VMs.

Anyone used Softether for work purposes?

Hi, I’ve got a site using old/outdated free VPN and I’ve seen softether mentioned a few times recently (www.softether.org - sorry on mobile not sure of formatting). Anyone used it? Is it secure? Was planning on using wireguard but waiting for officials windows support thanks

Beginner help in using wireshark

I have to use wireshark for my networking class, but my professor did NOT even give us a basic tutorial on how to use this program. This class is pretty much an intro into networking for my major. He told us to install it and gave us the prompt for the assignment, that's all. I'm trying to self teach myself on how to use this program, but I've hit a roadblock. The assignment doesn't look too difficult, but I have a hard time trying to figure out where to find the information he is requesting me to look for.

​

I run wireshark capture and go to reddit.com and wait for a bit before stopping the capture. My questions are how do I know which packets I am sending and how do I filter it? He is also asking me to find SYN/ACK packets. I see a lot of TCP packets when I use this filter: tcp.flags.syn==1 && tcp.flags.ack==0, but I am unsure which one relates to reddit.com.

How can you find the ip address of a device when you...

...have no knowledge of where it came from or the subnet it was in previously? Can you hook it up to a switch, mirror the port, run tcpdump and detect anything? How can you get it to send out packets if it doesn't seem to be doing that by default?

port isolation old HP procurve switches

I am responsible for the network administration in a dormitory and try to isolate the individual users from each other. The old HP procurve 2910al switches do not support private VLANs. What is the best way to do this? L3 routing? Source port filtering?