Tag Info

Hot answers tagged

6

Absolutely. In the TACACS configuration, you can restrict the commands you allow, but you would do better to move that logic into a web application, rather than give your customers direct access into the switches. Simply put, you can create very granular access control using TACACS, but it is very easy to screw-up, and keeping the user-> device -> port -> ...


3

The problem is like this: dmeg says the negotiation is complete but the switch is not ready and the led of the port on the switch is still red and it get a while for it to get green. Your problem seems to be that the switchport isn't configured as a spanning tree edge port. Edge ports are optimized to forward to quickly; otherwise the switch port goes ...


2

Set the VLAN on the NIC in the VM settings in Hyper-V manager and set the switch port to mode trunk with at least that VLAN allowed. Remember that you won't be able to route between VLANs with the same subnet on them, so you will need to change IP schemes if they need to communicate at layer 3 but be separated at layer 2.


2

You'd have to look up ip ranges per country. Google can help you there. These are a lot though, and making individual rules may make your firewall slow. Also, I don't know how to do that in a Cisco SG200, especially when you have one of those webinterfaces that only allow you to enter 10 rules, but using iptables on Linux, it's straightforward enough to ...


2

I don't think you can do this with just router advertisements. My understanding here is that you want the following setup: 2001:DB8::/48 via cisco default via linux The problem is that router advertisements don't let you specify static routes. They just tell all the hosts what subnets are available on the local network (meaning they can be reached ...


1

Search for GEOIP. you will have ip ranges by provider's countries (key point is here. it's providers country on paper.) Geographic division is actually meanless when we are talking about web. Anyone can have any IP address from anywhere. Also your geoip database must be updated regularly. More over your block list will be a long list. consider that rules ...


1

I'm suspicious that the switchport isn't up - what does "show interface fa0/1 switchport" say? With the exception of DTP (dynamic trunking protocol), trunking is unidrectional, which is to say one side of the trunk doesn't necessarily need to agree with the other side. Not that you'll get proper traffic flows if trunks are mismatched, but a non-trunking ...


1

A port must have a VLAN assignment. If you need it to be completely disconnected, set it to a nonexistent VLAN and shut down the port. interface fa0/1 switchport access vlan 901 no switchport access vlan 1 shutdown (I'm not sure if the "no" is required. Don't have a switch at my fingers with an open port to test). That said, shutdown should be sufficient ...



Only top voted, non community-wiki answers of a minimum length are eligible