First Entry to a True Enterprise Setup

Good day everybody.

This one is long. TL;DR - I am redoing the Wi-Fi at my work, currently there is home routers acting as access points all joined together with 100 down and 6 Modem providing it all. Looking for input how to replace it equipment that can handle the load of 300+ people at peak times.

I was going back and forth between homenetworking and networking to make sure I am in the correct sub but with how big my setup has to be I assume I would end up in this one. I will try to include as much info as possible.

I have dabbled with enterprise gear for my home lab but haven’t done a full setup for a commercial environment before.

My situation - I am in the navy stationed in guam and I have been designated for redoing the public Wi-Fi through out certain locations in the ship. There is roughly 300 users that will be on it during the peak hours.

How it is setup currently (You might chuckle a bit):

It starts with a 100 Down 6 Up Cable modem (Highest speed offered on the island) with a Linksys EA9400 Home Router that has two Cat 5E Cables coming out of the LAN Ports. This is in a public office space and Game Room. This sees about 35 people max.

The first CAT 5E cable goes from that router to a AC1700 TP-Link C20 home router in the gym a level below. This space sees about 25 People max

The second CAT5E cable makes a long 400+ feet run to a large eating area (Mess Decks) where roughly 250 people at one time can sit and eat. That cable plugs into another AC1700 TP-Link C20. That router in the eating area then has three more CAT5E cables from it.

The first cable runs another home C20 Router in a Lounge area. About 20 people will be in the space. The second cables goes to a Linksys EA7300 and that is in a officer eating area (Ward Room). This one will be going away soon since the officers are going to get a second modem for themselves. The third cable goes to nowhere and is assumed dead. (Tracking it down tomorrow)

To top it off, there is a random Wi-Fi booster attached to router in the public eating area (Mess Decks). No idea who is using it.

So my plan is to start from scratch. Whatever purchase plan for equipment will have to be presented to my commanding officer to get approval for purchase.

Since this will be a Wi-Fi only network, I will be relocating the Modem, Router, and Switch to help get even distribution of the new Ethernet cable.

As for new equipment, I was considering a Ubiquiti setup. I just trying to plan for when I detach from this ship and future growth for the network.

Edgerouter X (ER-X-US) Unifi Switch 8 60Watt (US-8-60W) 5x AP-AC Lite (UAP-AC-LITE)

Every public space will get 1 AP with the large eating area 2. One for each side of the room.

I hope I didn’t cause too much a headache asking for help. I am no means a professional and my local IT’s are just providing new cable and tools since most don’t know as much as myself (I am mechanic at work, Nerd at home)

Thank you and any advice is welcome.

Anyconnect Split Tunnel Teams - "Failed to Send"

Hey all,

Bit of a long shot but i was wondering if anyone has experienced the "failed to send" error on teams when split tunnelling on anyconnect? (or any vpn client). We are seeing a very small number of users experience this whilst the bulk of the organisation working with no issue.

We've split using their recommended approach using IP blocks and specific domains which ive listed below:

access-list split-tunnel-ips standard permit 13.107.64.0 255.255.192.0 access-list split-tunnel-ips standard permit 52.112.0.0 255.252.0.0 access-list split-tunnel-ips standard permit 52.120.0.0 255.252.0.0 anyconnect-custom-data dynamic-split-exclude-domains teams_traffic lync.com, teams.microsoft.com, broadcast.skype.com 

This is then applied and taking effect correctly.

Thanks in advance.

Cisco Nexus GNS3 licensing.

Hi all,

​

I was wondering if there is a way to run a fully licensed Nexus switch on GNS3. As far as I am aware, licensing works on "some" GNS appliances (IOU), but I have not seen anything in regards to Cisco Nexus.

Can I get a temp license for vNexus or do I have to purchase VIRL?

SD-WAN - Configuration Question

Hi all. We want to setup an SD-WAN in one of our offices. I've never dealt with SD-WANs before so was hoping someone can advise if what I think we're supposed to do is right/wrong:

​

1. Hook up the SD-WAN box between the ISP router and firewall (Checkpoint in our case)
2. Assign the SD-WAN a public IP address
3. Change the S2S VPN IP from that of the firewall public IP to that of the SD-WAN public IP
4. Change the default route of the firewall from the ISP gateway to the SD-WAN box

We're currently using Checkpoint's ClusterXL so we also have external switches that hook up both firewalls in case of failover so that's causing a bit of confusion as well.

Happy to elaborate if needed, I just want to get a grasp on this.

Network devices.

Hello r/networking(new member here) I am self studying data communications and I would ask for recommendations for a good book or a website for network devices(modem, hub, bridge, switch, router, gateway). I started researching on them individually on the internet, and I observed they have identical functions which confuses me a lot. And, if they have almost the same functions, why is there no all-in-one device in the market that have all the functions of a network device.

Open-source application detection

Hi,

So say I want to sniff network traffic and use the packets (not the ports) to identify applications, has anyone stumbled across an open-source application that can do that?

Thanks.

Richard

ERSPAN filter on Nexus 9300 to filter out GRE packets

Hi, as the title says I am trying to craft an ERSPAN filter that excludes GRE traffic. The intent is to limit the capture of other ERSPAN traffic flowing through device.

I have looked at Cisco documentation and tried to apply a filter as below but it hasn't been successful.

Has anyone made something like this already?

monitor session 20 type erspan-source filter access-group filter_gre

vlan access-map filter_gre 5 match ip address filter_gre_acl action forward

ip access-list filter_gre_acl 10 permit tcp any any 20 permit udp any any 30 permit icmp any any

When connected to an IX, why do larger orgs prefer bilateral peering ?

[For background, I look after a small AS connected to a few public IXs]

I have noticed that many larger organisations who are connected to an IX, do not use the provided route server for multilateral peering.

They often have an open peering policy and are happy to connect using the layer2 IX connection, but require establishing a direct BGP session between the two parties.

What are some of the benefits of bilat over the exchange link that make it preferable for these companies to avoid participating on the route server?

EDIT: Apart from just being curious, it caused me to wonder if I should remove our own AS from the routing server.

Cisco NTP server behavior

Hello,

I need some clarification regarding how NTP works in Cisco devices.

So right now my client wants to use one of their 6500 series switch as their internal NTP server for development network, but it doesn't seem to work at the moment.

As I understand, 'ntp master' command is needed for router/switch to act as a NTP server, but my colleague says it's not needed.

What I want to know is that if the router has an external NTP source configured (ntp server configured, but no ntp master), would it be possible for other switches to use this router as a NTP server?

Sorry if the question is hard to understand. English is not my first language. :p

Out of IPs on a dedicated server with lots of resources and VPS capabilities... Options?

So, I'm out of IPs and the colo company for my dedicated server wants to charge an insanely high amount for a block of 5 more IP addresses.

I'm wondering if I'm screwed or if there are other alternatives to getting an IP on the box? I can setup VPS with NAT using the dedicated server's IP to have internet, but I am wondering if there is an option to get more public IPs either through some kind of tunnel or VPN etc?

Does anyone have any insights into a cheap and reliable way to get this done without having to give in to extortionist IP prices from the colo provider?
Thanks!