Adding another switch to the stack. Got questions.

I recently started a job at another company. On my previous job 90% of my work was routing related, and remote, so im off my bubble here.

Today i got assigned to me a ticket about adding another switch to an existing stack of 3x Catalyst 3850.

I already changed the priorities to make sure the master switch remains the same, and changed the IOS of the new switch to the same as the ones on the stack.

The switch hasnt been added to the stack yet since the stack is on a client.

My question is, do i need to actually configure anything on this 4th switch? Like local user, etc. It just seems too easy if its just like this.

Rant Wednesday!

It's Wednesday! Time to get that crap that's been bugging you off your chest! In the interests of spicing things up a bit around here, we're going to try out a Rant Wednesday thread for you all to vent your frustrations. Feel free to vent about vendors, co-workers, price of scotch or anything else network related.

There is no guiding question to help stir up some rage-feels, feel free to fire at will, ranting about anything and everything that's been pissing you off or getting on your nerves!

Inventory flash of Cisco switch

I just started a mini project to upgrade 200ish Cisco switches. I wrote a quick and dirty script to stage the software, and it looks like it worked from what I see.

My boss however is asking to provide him "proof" that all the switches have the correct software staged (even though we're doing the upgrades manually one-by-one to make sure nothing goes wrong).

Does solarwinds or a similar tool have the ability to do a report or inventory on network devices' flash? Or should I instead focus on doing a check via python?

I hesitate to use python because to my boss it's sorcery, and I'd hate to put a few hours into creating a script to do something only to have to do it again a different way.

Question about QOS/Shaping/L7 filtering/DPI for NGFW admins/engineers

I currently run an Allot NetEnforcer/NetXplorer (packetshaping/DPI) with a Cisco ASA. We are getting ready to bid out a whole new internet edge. I am curious if anyone has any insight as to whether or not NGFW platforms (i'm looking at FortiNet and Palo Alto - though, I have not engaged either on the topic yet) negate the need for a dedicated shaping/QOS/L7 filtering/DPI appliance. I'm primarily interested in dropping P2P, keeping Netflix/Streaming contained up to a certain percentage of overall bandwidth, guaranteed bandwidth for various subnets, etc. Just curious if there is any opinions out there as to whether NGFW handle this and handle it well.

2 pppoe connection in nanostation m5 router

hi i want to make a 2 pppoe connection in nanostation m5 i have tried this method in the link
http://waseemmeo786.blogspot.com/2016/02/multiple-pppoe-connections-on-ubiquiti.html
it connected to the pppoe and i have got ppp1 but with no internet connection

i thought that the problem is in traffic so is there any way to get the two pppoe work together and make the nanostation get the packet from the two connections?

Duplicate TCP SYN

My ASDM log is full of these with varying source IP, but all go to destination 192.168.0.1, which is not an IP, object, interface, or subnet we use. I can't find any reason for that to be a destination port unless it is on by default and the firewall doesn't know what to do with it so it dumps the SYN. SYN attack for 10-min and 1-hour is 200+

4 Feb 12 2019 14:34:13 192.168.100.87 54785 192.168.0.1 49152 Duplicate TCP SYN from inside:192.168.100.87/54785 to inside:192.168.0.1/49152 with different initial sequence number

4 Feb 12 2019 14:35:42 [ 192.168.101.179] drop rate-1 exceeded. Current burst rate is 0 per second, max configured rate is 10; Current average rate is 18 per second, max configured rate is 5; Cumulative total count is 22279

Any idea why my objects are sending packets to 192.168.0.1, which shouldn't exist?

​

Website hosting and Audit Failures

I have been battling with these audit failures all day and cannot seem to figure out where they could possibly be coming from, I've checked the windows firewall (port 80 is allowed from remote), my anti-virus (I use Kaspersky), even IIS (what I use to host the website), and nothing seems to be blocking it, web visitors are able to view the website just fine with no errors, just I keep getting Audit Failures in event viewer when a visitor lands on the page, any suggestions?

Event[0]:

  Log Name: Security

  Source: Microsoft-Windows-Security-Auditing

  Date: 2019-02-12T13:47:25.497

  Event ID: 5157

  Task: Filtering Platform Connection

  Level: Information

  Opcode: Info

  Keyword: Audit Failure

  User: N/A

  User Name: N/A

  Computer: *

  Description:  The Windows Filtering Platform has blocked a connection.

Application Information:

        Process ID:             4

        Application Name:       System

Network Information:

        Direction:              Inbound

        Source Address:         ...

        Source Port:            43702

        Destination Address:    192.168..

        Destination Port:               80

        Protocol:               6

Filter Information:

        Filter Run-Time ID:     242535

        Layer Name:             Receive/Accept

        Layer Run-Time ID:      44

Brand New Office, Brand New Technician, Brand New Building. Starting from Scratch, More or Less

I am a techinican with the DoD, I have 8 months of formal training (mostly useless), along with over a year OJT and 2 years experience after that. I have just been put in charge of taking care of a (much smaller) existing network, while preparing for new infrastructure after the customer organization moves in a year or so. I have a brand new technician on the way from training, so I will also be training him, but that's mostly beside the point.

Starting from nothing, what cabling techniques and termination devices have been the best in your experiences? Are the EZ RJ45 crimpers worth the 250% markup? Any recommended test equipment as well? What are some early pitfalls that I could avoid?

​

Thanks in advance!

​

Edit: Apologies for being unclear originally. I am strictly a maintainer. I will be help desk after the new network is up, but I am transitioning from a workcenter with all standards and procedures in place to nothing. I don't want to just reproduce what I know without hearing some other input.

Disclaimer: DoD network, I don't have complete control over it, but I should have most of the layer 1-3 administration. Flipside, funding shouldn't be too much of an issue if I can justify it. Also, I apologize if this slightly infringes on Rule #5 but I wasn't sure.

eBGP multi-hop

Hello, I was listening to an episode of the Network Collective podcast. I don't recall the exact episode, but it was regarding BGP. Someone on it said that people erroneously believe that the command neighbor <ip addr> ebgp-multihop 2 command is required to have a peer relationship work between two directly-connected routers that are both using a loopback interface for the neighborship, when in fact the command is not required b/c after the router decrements the TTL from 1 to 0, it will see that the packet is meant for itself and therefore read it.

When I lab this in eve-ng using Cisco IOS (IOL images), the ebgp-multihop command is required for the neighborship to work. Does anybody find this behavior to be different depending on the vendor or platform?

Since a router is supposed to discard packets after the TTL reaches zero, and it's supposed to decrement the TTL before even doing a route look-up, I don't see why a router would first see whether it owns the destination IP address in the packet before deciding what to do with the packet. Unfortunately, I can't think of how to test the behavior other than by labbing eBGP with loopback interfaces.

Edit: Adding configs so it's clear. Neighbors share the 1.1.1.0/30 subnet (rtr8 is .1 and rtr9 is .2).

rt8#show run | s router bgp router bgp 8 bgp log-neighbor-changes neighbor 9.9.9.9 remote-as 9 neighbor 9.9.9.9 ebgp-multihop 2 neighbor 9.9.9.9 update-source Loopback0 rt9#show run | s router bgp router bgp 9 bgp log-neighbor-changes neighbor 8.8.8.8 remote-as 8 neighbor 8.8.8.8 ebgp-multihop 2 neighbor 8.8.8.8 update-source Loopback0 

Security/IoT project ideas

Hey there, I'm a college student doing my masters degree.

​

I'm finding it hard to think of a cool and exciting project idea that will impress my professors. The security project must include IoT otherwise I'll get a failing grade.

​

I'd love to hear what your guys' ideas, hopefully I'll find an interesting one. If I do, I'll definitely credit you for it, unless you don't want to of course.