Multicast on Avaya 4550T & 36xx Switches

Need a sanity check here to see if I'm on the right path. I'm trying to lab some multicast paging devices before installing it at a customers site. It will consist of some server units at one location and some receivers at a few other locations on a L3MPLS network (going to need to tunnel over this). Recipient speakers will vary depending on which paging function is used. To mock this up I've set up an old Avaya 4550 switch with some SVIs on it in our lab and placed each device in a different VLAN based on what location it will live at once installed. I may hunt around for other switches later but I also have an Avaya 3526 to use though I don't think it will matter since the multicast docs on it are identical.

Where I'm stuck right now is my discovery/programming tool usually only finds the paging devices on the same VLAN as my laptop is plugged into. Every device is already configured with the correct IPs. I'd like to say the occasional discovery of other devices is a quirk or some misconfiguration on my part in the device/tool. I'm going to Wireshark and play with it more tomorrow to see what it's doing so I'm mostly concerned with the multicast parts. I've enabled IGMP snooping and IGMP proxy on each SVI and it looks like the switch sees all the joins and is happy with it.

To my knowledge, the network consists of a mix of my own Avaya 36xx series switches and my customer's Meraki stuff (firewalls/switches) but I'm going to try and get more details on the topology tomorrow just in case I'm responsible for some routing instead of just their Meraki stuff. I'm also unsure if I'll be able to make this work without PIM in the event that my switches are doing routing on the network since the docs for these switches don't mention PIM anywhere and I haven't been able to ? my way to PIM anything on the switches.

I THINK I need PIM at this point (PIM-sparse in particular from what I understand) to get across the VLANs on this switch and later my customer network. I also found some stuff about mrouter ports but I'm not solid on what they're used for. From the documentation I've read is that they're used for when you have more than one querier on a VLAN that the switch can see and you want to receive traffic from more than one, is that correct or close?

Is it possible to reliably get multicast to route across a multisite network without PIM?

Cisco ZBF vs. Cisco ASA

Anyone here actually implemented/designed firewall segmentation with a Cisco router?

If so, what were the biggest differences between that and going for the ASA? ASA code seems to be a dying ship, but I like the famularity of Cisco products and mpf

Juniper SRX300 bandwidth limit using web GUI

we have a spare srx300 and my team is insisting me to use it for the new branch office. i prefer to use pfsense since its easy to use(web GUI). is there any way we can configure bandwidth limit using its web gui? their web is kind of lacking functionalities. i try to avoid the CLI since it will be hard for my team mates to do troubleshooting.

my goal is, like in pfsense setup.

network coming from vlan11 will share 15mbps up/down speed, vlan12 5mbps up/down, and so on.

this is our possible setup. (still considering replacing srx300 with pfsense)

internet -- srx300 -- cisco core switch -- L2 switches -- PCs 

Question about Multicast RPs

I have scoured the Internet, manufactures technical sites, books, and the search function on Reddit but I cannot find the concrete answer I am looking for when configuring Rendezvous Points in Multicast.

Should the RP be an actual L3 interface on the router or is a interface-less IP sufficient enough for the RP? If it is an interface, what is the best practice interface? One exclusive to the RP?

I am assuming the RP IP not associated with an interface isn’t sufficient however I am uncertain. I am also betting that an IP exclusive to the RP is the best way to go.

Thank you everyone for checking this out, and I am working on a Juniper Platform.

Is there a way to know if a public IP that isn't in the RFC1918 ranges is used privately?

No text found

PAGP etherchannel caused stack-mgr to freak out.

Maybe there is an obvious gotcha, but so far I haven't found it.

​

The story so far...

I was creating a LAGG between a 9300 two member stack and a 3650 two member stack. I ran out of 10G interfaces on the 3650 end, so I thought I'd toss a 1G interface into the LAGG group as sort of a standby (I know you can't mix 10G and 1G interfaces since they run at different speeds).

​

If I configure the member interfaces with `channel-group 1 mode active` they come up as LACP, as expected, no problem. The problem is that sometimes the 1G would be `(P) - bundled in port-channel` while the 10G would be `(s) - suspended`, or vice versa.

​

Then I got the bright idea of giving 10G a higher priority... somehow.

​

PAGP's "port-priority" sounds promising. So I set the 10G interface to `pagp port-priority 1`, the 1G interface to `pagp port-priority 255`. Thinking everything looks ok, I `no shut` the 1G interface, was about to `no shut` the 10G, when the 3850 seems to go offline (console dead, can't ping it). I eventually get on the serial console, and before doing anything else, I `shut` the 1G interface, since that was the last change. Right after doing that, I see a bunch of stack-mgr message scrolling by... WTF?

​

Both stacks are using stacking cables, not virtual stacking. So i'm at a loss.

​

Is there a footnote on PAGP port-priority on stacked switches I'm missing?

Theoretical Network Security Question

I have a firewall gateway with all ports closed from external access. I have an internal host who reaches out to a web server on port 80, and generates an arbitrary port of 6000 for the return. If I set a port scanner on the firewall, when the traffic is returning, will I see port 6000 open on my firewall for external access?

Transparent VS explicit proxies

I have a question regarding configuration of these. Prefacing that I know that they work above the Layer 3 layer, so I'm more trying to determine how they interact with L3.

​

An explicit proxy is pretty easy, your browser has the settings configured to use the proxy to communicate and it points the web traffic to that address. All your underlying Layer 4 architecture works as it should, gateways are your routers out of the network or firewalls, etc...

​

How do transparent proxies work exactly? Does the router/firewall point to the proxy as a next hop? Does the proxy intercept ARP requests and provide it's own MAC if it detects outbound traffic? Is it physically in-line behind a router and intercepts all protocol appropriate traffic?

​

I've only ever worked with explicit proxies and a smidge not sure how transparent ones work in deployment.

What's your scripting success story?

I scripted the creation of IPSec VPN configs for ASAs based on user input. It checks existing configurations (policies, crypto maps, ACLs, etc.) to determine whether the new configurations are necessary, and omits them from the file if so. I'm proud of it, but I feel like there's a lot more that could be accomplished with SDN (if my example even counts), so I'm curious to hear your success stories to get some inspiration and whatnot.

Zeroconf networking and Avahi - how to?

I am currently exploring zero configuration networking with a set of devices on a network. I've spent a few days doing all research possible regarding zeroconf, and while I found loads of threads about how to fix problems, I didn't exactly find an article or anything that explained how to use something like Avahi. I have scoured the web and found that Bonjour and Avahi are two major implementations, and the purpose of zeroconf is that it minimizes the burden of going through each device on a network and setting up network services. I felt this subreddit was my best bet at getting some information on the subject. Since Avahi comes with Linux, I'm looking for help with learning how to use this rather than Bonjour right now. I guess at the moment, I have two main questions regarding zeroconf and Avahi (daemon):

1. I thought a device would have to have an IP address in the first place to be able to be on the network. How does zeroconf set up network services for a device that has just been added to the network? As in, how can the device be discovered and set up if it doesn't even have an IP address?
2. How does one go about using Avahi (specifically, daemon)? I have checked so many sites and I keep finding people who have had issues with it, but I really am just looking for a how to use it, regarding commands and such. I may just not be searching with the right keyterms (just been searching "mDNS", "zeroconf", "how to use Avahi"), so if anyone could point me in the right direction, that would be awesome.

​

Any and all help with understanding this is much appreciated!!

​

*EDIT: spacing