site-to-site mesh backhaul with spoking sub mesh, and link bonding to internet.

Baiscally I am just wondering on the validity of this being possible.

If I say, have four neighborhoods in corners of a small city, that have their own small mesh networks, is it possible to plug in a long range radio and have all of them pipe together?

The other part, is link bonding withing the mesh. Each person with a mesh AP plugs their internet connection into the mesh network via that AP, is it possible to link bond within the small mesh, then run it out of the back haul stated before,between all of the smaller meshes?

I know this is an extremely long shot. I just wanted to satisfy my pedantic mind by getting an answer either way.

How does a DNS resolver work?

I've been looking on the internet how DNS work but so far I have only found explanations that are very superficial about it.

What I understand so far is that there 13 root servers. First you make a request to your DNS server, if its in cache it will reply with the IP, if not then they send the request to a root server, they will reply to look at an authorative Top domain DNS server (Let's say .com) and then those servers will reply to look at the nameserver DNS, which will return an IP if it exists.

From my understanding this are 3 layers. You got your root servers, top domain servers and the nameserver. An average user who owns a website will be able to control the nameserver and the registrar which links your domain name to a nameserver of your choice.

My question is how does a DNS resolver work. Like Google have their own DNS (8.8.8.8 and 4.4.4.4) but how do they set it up so they can query root servers, then top domain name server and finally the name server. Can an average user have their own DNS resolver? Or you need to be some sort of business or ISP to do it?

QoS - Setting arbitrary bandwidth limits on switchports

We are a small shop that have the opportunity to supply internet via the municipal fibre network to local businesses.

Our network is not really prepared for this and we have no way to limit bandwidth for each customer. Right now they are only bw-limited by the capabilities by our 3560 100mbit switches that we have in front of the customers.

I'm looking for ideas as how to deal with this. We currently just route a small ip subnet over layer3 switches to each customer.

Some customers only pay for 10mbit, others 30mbit and some 100mbit. And right now everyone has 100mbit. I'm pretty clueless as to what options there are to limit bandwidth.

Anybody doing anything similar? What hardware/software do you use?

2 NICS for 2 remote access

I have 2 NICS in the server:

The first one: 110.110.1.254 - Connected to Router1 The second one: 192.168.0.20 - Connected to router2

So i used port forwarding in their respective routers to make it accesible but the router2 doesnt seem to be working, if i change the port forwarding to another local machine (192.168.0.55 for example) it does work fine.

So i believe the problem is on the local machine with the IP 192.168.0.20, i disabled the firewall and it doesnt seem to be the problem at all.

A routing problem maybe? A port problem?

MMA - Midnight maintenance Adventure, seeking IOS advice!

Midnight Maintenance Adventure (MMA)

Imagine, you opened a plain brown box and unpack a sleek 3650-8X24UQ, get real excited and deploy it removing a perfectly stable 2960XR from production. Things work fine for about 48 hours, then the 16.3.3 IOS switch spontaneously crashes. 110 customers file support tickets. Support department head throws a fireball at you doing 50 HP of damage.

You do a 2am upgrade to 16.3.5b. Network engineer calls you at 7am to say it looks bad, you revert to 16.3.3 and your mac address table immediately goes from 320 MACs back to 740. Things look OK, but you know 16.3.3 has issues.

You desperately ask on a forum, what about 3.7.5, it works so well on the 3850 switches?!? You are warned about a demon named ROMmon. You are advised to move on swearing-like-a-sailor-kicking-and-screaming. Rereading the advice, the person somewhere in the depths of the Internet has edited their post, and the information is different. It just says file a TAC ticket and the swearing-like-a-sailor-kicking-and-screaming line was removed from their post. You are confused it is 4am.

You file a TAC ticket. Turns out 16.3.3 is cursed with Entropy exhaustion (CSCvc88106) and Memory Loss (CSCvb48912). You look at the memory graphs you are diligently graphing and predict you have until 10am before the next spontaneous reboot.

Asking the wise TAC sage what version to run, they respond with, "As Cisco TAC engineers we cannot recommend any specific code release." Confusion spell gets worse.

Make a choice, adventurer, what do you do?

• 16.3.3 - stay with memory leak, reboot every 48 hours + port isolation busted (CSCun82902)
• 16.3.5b - half the mac addresses on network become unreachable - doesn't actually crash
• 16.6.2 - dark horse, yet to deploy. Downloading right now.
• 16.2.2 - old version, has other bugs
• 3.7.5 - not offered as a download, try to brick device with 3850 IOS and risk future ROMmon incantation

bonus option Do you turn off IPv6 everywhere for good luck?

Confused about IP address.

My IP address when looked in google is different from the output of ipconfig command. Please help understand.

Thoughts on using a Netgate SG-1000 (pfSense) for a 3-5 person remote site-to-site VPN?

I'm looking into alternative options for getting a small remote site (3-5 employees) on a permanent VPN connection to our main location.

We currently have no hardware at the remote site. Our MSP is pushing (what I consider to be) an expensive Dell SonicWall NSA 2600 solution and my job is to convince the brass that we can accomplish the same thing for a boatload cheaper.

Our main site (~60 users) uses SonicWall NSA 2600 as the security gateway and Sophos products at our larger overseas offices (~30 users). These offices are connected to main using IPSec.

The VPN needs of the branch are very minimal - they've been running with software VPN connections for the past 2 years or so with no problems (each person connecting once or twice a week).

However, their lack of permanent VPN makes it hard to administer their PCs or get them to use internal websites such as our git repo or wiki.

So would the Netgate SG-1000 be sufficient? Or should I push slightly beefier SG-3100 / SG-4860?

---

Note that are our MSP is not fully managing our IT infrastructure. They're moreso just doing helpdesk type things. I am the de-facto onsite IT/DBA/DevOps/Software guy.

Edited for grammar.

[RADIUS] Meraki Mac authentication & account creation using pfsense and freeradius?

Does anyone have experience with this?

I'm looking to build essentially a captive portal that would authenticate over RADIUS (i'm assuming) but instead of displaying a splash page, I need to generate an account (stored in SQL or some db) and keep it associated with the client mac from thereafter.

Transdepartmental roaming between APs would also be a bonus.

This guy sounds like he's on the same path but with a different router/AP: http://ift.tt/2juIs2P

"Sun Jul 17, 2016 7:52 pm

I am thinking the name cannot be empty when adding a mac entry in the hotspot user list. Password is not used if method (login-by) is mac. Name could be generated from the current date time by the client php code.

So the user only needs to accept terms. The two important fields (mac and name) are generated by client code >and then posted to the server.

The server being a separate machine that has been wall gardened. The server sends out the accept page. The server receives the mac and name fields then opens a separate >connection to the Mikrotik. Through the API it issues a command to add a new user. The server then sends a redirect page back to the user. The Mikrotik now sees the mac is in the authorized user list allows the user through.

Using a date in the user name allows a nightly script to clean out users if desired."

I'm thinking AWS Simple AD for the accounts.

Thanks!

Vlan/trunking issue, converting inherited flat network to router on stick vlan

The cisco router had a bunch of secondary ip's on its lan interface. So after upgrading the switches throughout I started migrating the secondary ip's to sub interfaces. My understanding was sub interfaces should work even if the main interface has ips on it. But, while I can ping other vlan ip's on the router from the native vlan (1), I can't ping the non native vlan ip's on the router from their own vlans. So switch1 port 10 has a client with ip of 10.0.2.5 say, and it can't ping 10.0.2.1. But it can ping another client, say 10.0.2.6 on switch2 port 10 no problem. I have no idea why. I thought maybe I was wrong and subinterfaces don't work when there are ip's on the parent interface, but then I can ping 10.0.2.1 from other ports not configured for vlan 20. What gives?

Router: Gig0/1 ip address 10.0.0.1 255.255.255.0 ip address 10.0.1.1 255.255.255.0 secondary ip address 10.0.2.1 255.255.255.0 secondary to: gig0/1 ip address 10.0.0.1 255.255.255.0 ip address 10.0.1.1 255.255.255.0 secondary gig0/1.20 encapsulation dot1q 20 ip address 10.0.2.1 255.255.255.0 switch1 gig1/0/10 switchport mode access switchport access vlan 20 gig1/0/48 descrition uplink to router switchport mode trunk gig1/0/49 description uplink to switch2 switchport mode trunk int vlan1 ip address 10.0.0.2 255.255.255.0 switch2 gig1/0/10 switchport mode access switchport access vlan 20 gig1/0/49 description uplink to switch1 switchport mode trunk int vlan1 ip address 10.0.0.3 255.255.255.0 

Looking for this sticker from Ciena gear

My laptop died and has to be returned to my employer. I had this sticker from a past life in the network world, if anyone has one they would sell I would be willing to pay several hundred pennies.

cool sticker