Tier 2 vs Spine-leaf broadcast BUM handling

3 years ago we build small datacenter with vPC using cisco nexus, HRRP all sort of things but later we just started adding more and more racks and now i have 45 racks and and around 100 switches including 2xTOR and core etc.. now it's giant L2 network (yes we are using vPC so every link is active-active) but question is do i need to worry to add more 10 racks in existing network?

STP is dangerous for large network but does it act differently with we use with vPC (reduce BPDU etc?), same way i am also worried about BUM traffic in L2 network.

Now it's too late to convert Tier 2 design to Spine-Leaf :( we know spine-leaf eliminate STP at leaf level but now question does it going to help with BUM traffic using evpn? (if yes then how much it help with BUM)

​

Soon we are going to open datacenter in one more co-location and i want to make sure i understand everything before we say let do Tier 2 vs Clos design. what do you think?

Cost per user for the network

Hi all,

Bit of an odd one, but an external company has taken over part of our business. The staff will move over but they will remain on our sites, eventually using their own laptops etc.

As the network and security dogsbody, I've been asked to come up with a cost per head for their usage of the network/firewalls/Wi-Fi etc to charge back to them. Has anyone else ever had to do this and how did you go about it?

Packet Captures for displaying TCP Congestion Control

Hi all,

I’m very here and I need a very urgent help from y’all. I hope you’ll able to help me out.

I have to give a presentation tomorrow on Congestion Control and Avoidance tomorrow. So initially, I did think it’s a straightforward thing where I just give a very brief overview.

But I’ve just been informed that this is a 3 hour sessions and I should show packet captures and what not.

Now I must be frank here, I don’t work with Networking related aspects at all, and I only know the very very basics. All I know about TCP is the 3 way handshake and I did read up the very basics of congestion control and avoidance over the weekend.

If any of you could tell me where I can get the required packet captures from and where I’d be able to learn much more in detail about Congestion Control, I’d be eternally indebted.

Looking forward to hearing from y’all

Addressing on Tunnel Interfaces

When using tunnel interfaces for IPSEC to enable dynamic routing, what's the right way to address them?

I took a /24 from the larger subnet used at this company and broke it up into /30s for addresses on each tunnel. That's all working fine and routing is working properly.

This has led to each of those /30s showing up in the routing table across all routers. I'm not sure whether that's a problem and a sign that I'm doing something wrong or if it's normal and I'm just not used to seeing it.

Devices are sonicwall. I'm using tunnel interfaces and ospf so that I can control link costs and because many sites have multiple ISPs, Ethernet point to point links, etc.

SPF records: Will records, not included in the spf record at root level of a domain, validate emailservers ?

Hi,

I have a question regarding spf records.

Do records, not included in the spf record at root level of a domain, validate emailservers ? For example: I have a domain (company.com), which has a nameless record (record 1) with these values:

v=spf1 include:_spf.company.com ip4:123.123.123.123 include:_spf.domain1.com -all

So there is another record (record 2): _spf.company.com which include some other values.

I see why this is working. Record1 points to record2 and therefor an external mailserver is validated as valid sender and mail is being deliverd.

But, there is some other records that seems to be on it's own: (record3) E.g _spf_orphin.company.com - v=spf1 include:ip4:111.111.111.111 include:_spf.otherdomain.com -all

I don't see another record pointing towards it.
Will mailservers included in this record (record3) be validated, or will they just be skipped because no other records points to it ?
Or do all records who's value starts with: "v=spf1" count as a valid spf record to which spamfilters can validate ?

Thanks in advance !

Dot1x Issues with Lenovo Thinkpad Dock station

Hi!

We recently tried to deploy wired dot1x in one of our environments (machine authentication), but some of the clients would not authenticate properly. It seems that the users that have a Lenovo Thinkpad 40A1 Dock Station would not "present" their certificate properly (or authentication server simply states that there is an unknown CA in the Certificate Chain), but when the client was directly connected to the switch it would authenticate without any issues (bypassing the dock station).

We also got it to work by removing the configuration from the client NIC (and keeping the configuration on the dock station NIC) which complicates things since not all clients are using this type of Dock station and it would be near to impossible to keep apart in the GPO Dot1x settings. It would also cause the client to not authenticate properly if/when roaming to conferance rooms (utilizing other dot1x enabled switchports).

Authentication Server: Cisco ISE

Switches are 2960X(TS&PS)

​

Do you have any ideas on how we could proceed/investigate this further? Anyone with similar issues?

Changing work laptop

I've a work laptop which is part of the work domain. Is it possible to clone the disk to a newer laptop and retain all rights of the domain? My issue is that work laptop is quite old which is not being upgraded hence I would like to buy a new one and use that at work. However, I do not want admin to get involved. I've admin rights on my current work laptop if that makes any difference. Thanks

Does CE5880-48T6Q-EI support 1+1 fan module backup?

Does CE5880-48T6Q-EI support 1+1 fan module backup?

Netmiko save config on Cisco question

start_time = datetime.now() net_connect = ConnectHandler(**device) cmd = 'copy flash:/c880data-universalk9-mz.154-2.T1.bin flash:/test1.bin' output = net_connect.send_command( cmd, expect_string=r'Destination filename' ) output += net_connect.send_command( '\n', expect_string=r'#', delay_factor=2 ) end_time = datetime.now() 

Hi, so i've just started getting into Python and Netmiko and i'm wondering what exactly this part of a script does? I think i have a fairly good idea but a few things are confusing me.The.....

output += net_connect.send_command( '\n', expect_string=r'#', 

.....part. This script is to get around a prompt from a router when asking for another answer to the save config on the Cisco CLI. It looks like its using the expect_string Destination filename to look for that in the output from the command, okay fair enough i get that, but it looks like the output variable is being combied with another send.command() command as well looking for a new line and then expect_string=r'#' which i've no clue what it is doing...I know the delay factor is used for timeout, it's mainly the other things i've mentioned which i'm at a bit of a loss about...

Thanks again everyone for the help

Update after more thinking.....

Is the "expect_string" argument just looking for that identifier, so a "#" and "Destination filename" and once it finds it, it moves onto the next piece of code?

Viasat is blocking and spoofing responses for TCP Keepalive packets

I've been running packet traces to some of my servers with Wireshark from the Viasat network while generating TCP keep alive packets using https://github.com/davepacheco/tcpkatest and it appears the Viasat router is blocking and spoofing responses to all of these packets, this is causing major TCP connection drop/reliability issues with many of my applications.

I've confirmed that the TCP keep alive messages are not making it to my server by running packet captures on the server at the same time as I generate them from my laptop, I've also verified that my test server is capable of receiving TCP keep alive packets by sending them from a virtual private server on a completely different network.

In addition the router appears to be spoofing responses to the keep alive messages with the responses coming back faster than the minimum Viasat latency would normally allow for so I'm fairly sure it's the router itself blocking/spoofing these packets.

Has anyone else seen anything like this before?