Tag Info

Hot answers tagged

23

The only people I have ever met who use the terms "Class A/B/C" are people who are using them incorrectly to mean a /8 or a /16 etc (except for just one person who used "Class A" to be the first octet, "Class B" to be the second octet, etc. But he was an idiot who refused to change his phrasing even though it led to so much confusion). So go ahead and learn ...


23

You should know three things about class-based-routing: Class-based routing was a simpler system that was abandoned (in 1993) long before most people ever heard about the Internet. In all likelihood, nobody you will ever know has used it. And if any of your network equipment is that old, you should seriously consider alternate employment. The system used ...


13

In a word, yes. People will often talk about it in the same way that the course material does. Nobody uses classful networking, or at least nobody I've encountered; during infrastructure/architecture planning people will often say things like "we'll set them up with two class C's here." It's easier than saying "we'll give them a /23" or ...


11

You would make TFTP access over the internet secure the same way you'd make access to anything over the internet secure. By going through a VPN. Cisco's IP phones can be set up to use a VPN, and someone even put together a handy doc around common issues with this setup that you might want to take a look at.


9

Then you can't do it. You've rejected another protocol that permits authenticating the requestor (hcsteve's answer) and you've rejected a VPN which would have allowed TFTP to be tunneled through an authenticated service (Hopeless N00b.*'s answer), so you're stuck with stock TFTP. RFC 1350 makes it fairly clear, in section 1, that authentication is not an ...


9

Nope. The Cisco RV110W device you have contains a dedicated WAN port. This is a physical hardware port intended for this purpose. You will not be able to reassign WAN functions to one of the four switch ports. More importantly, equipment damaged in an electrical storm really should not be trusted. You're going to have to replace this router.


7

The combination of switchport access and switch port trunk allowedmakes theswitchport access` configuration a no-op, right? You cannot have a port in access mode and trunk mode unless I am mistaken. Can someone confirm this for me? Not exactly. Let me break down the configuration: interface Port-channel1 switchport access vlan 100 ...


7

It means Silicon Switch Processor a high-performance 7000 series router. According to the answer from dtlokee in this Cisco forum, it does stand for SSP. They use the Si for the "silicon switching", I guess it's a bit dated but that is how they would represent a switch doing L3 switching in hardware. Now I think it goes without saying that multilayer ...


6

In your question's scenario : No. It would either work (meaning that your ports have Auto MDI-X, which is built into Gigabit Ethernet, IIRC) just fine, or not work at all. Which means the cause of your problem is elsewhere.


6

Absolutely. In the TACACS configuration, you can restrict the commands you allow, but you would do better to move that logic into a web application, rather than give your customers direct access into the switches. Simply put, you can create very granular access control using TACACS, but it is very easy to screw-up, and keeping the user-> device -> port -> ...


5

As an Information Assurance (IA) principle, the less unnecessary services running on a device, the lower the attack surface. To mitigate issues, proper configuration and patching levels are key. Changing ports is one of many elements you can do to lower the potential security risk. Cisco has an excellent guide for proper implementation of the HTTP/HTTPS ...


5

VTP is proprietary to Cisco. Juniper implements something similar with GVRP and MVRP (both industry standard protocols). You'll need to look into both of these protocols to determine exactly what you need and how to deploy them though. It's not something that is a quick "everyone can just run this CLI command" thing for these to function properly.


5

The no setup express command disables the functionality that resets the configuration when the MODE button is held. I suspect this will do what you're looking for.


5

Unfortunately, no, IOS does not support anything like this. The closest feature would be object-groups for ACLs, which were added in 12.4(20)T. They allow you to define an object-group containing the IP address(es) (or TCP/UDP ports or other things) you want to filter on. You would then reference the object-group instead of a static address in your ...


4

You've already discovered that there's two sets of RAM on the 6500/7600 series supervisors - the switch processor or supervisor RAM, and the MSFC or "route processor" RAM. The terminology isn't helped by there being three different names for each of these two components. The "sh ver" output is for the MSFC (RP) (add the two values together). "remote command ...


4

You have a misconfiguration on the link between the 2 routers. On the "left" router1 fa0/0 has an ip address in the 192.168.99.0/24 range. On the right router0 fa0/1 has an ip in the 192.168.3.0/24 range. Thus both routers can not communicate with eachother. You need a seperate subnet between the 2 to make this work.


4

I see that this question was asked in April 2010. Good news is that four years later (April 2014) Cisco released ASA software version 9.2(x) with new BGP support! See the ASA 9.2(x) release notes for details. If you're using the ASA 5505, you should review the 5505 RAM requirements listed in the release notes. ASA users have been asking for this feature for ...


4

show sessions will display outgoing connections from your switch/router to other devices. show users will display incoming connections to the vty interfaces (ssh/telnet...) of your switch/router. So i think you need show users here.


4

It appears that someone can't spell phoneproxy correctly when they typed it in setting it up. Regardless it's for CUCM's phone proxy feature on an ASDM firewall. See here: http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/unified_comm_phoneproxy.html Here's the gist of it: The Cisco Phone Proxy on the ASA bridges IP ...


4

Sure, that info's usually in the output of show version , though that might vary with specific devices and software versions.


3

Please have a look at the following: http://msdn.microsoft.com/en-us/library/azure/jj156075.aspx According to the documentation, assuming all of your network information is correct, you should disable Perfect Forward Secrecy if you are using static routing.


3

what is the difference between inside_access_in and inside_access_out ? Inside_access_in and Inside_access_out are just friendly names for your access lists. In your case, Inside_access_in is an 'Inbound' access-list, and inside_access_out is an 'Outbound' access list. An inbound access-list is applied to traffic as it ENTERS that interface. ...


3

The problem is like this: dmeg says the negotiation is complete but the switch is not ready and the led of the port on the switch is still red and it get a while for it to get green. Your problem seems to be that the switchport isn't configured as a spanning tree edge port. Edge ports are optimized to forward to quickly; otherwise the switch port goes ...


3

One potential problem with HTTPS is that lazy people (like me) may not set up a Kerberos certificate on the device to ensure that connections to it are secure. Your certificate would have to come from one of 3 sources: a commercial certificate authority like Verisign (expensive), setup your own CA using a Windows or Linux server (not that hard, but time ...


3

Does your host use a DNS name? If so, ask for DNS rewrite to be enabled on the Cisco ASA NAT rule for your host.


3

Devices in the same subnet don't need router to access each other. Learn networking basics.


3

I believe DD-WRT will this, e.g. to set up the other LAN ports under separate, NATted subnets, and other neat tricks. DD-WRT is a complete firmware replacement, that installs a very small version of Linux, and the tools necessary to manage it. You can find it at dd-wrt.org, with probably a better explanation, instructions, and so forth. dd-wrt is ...


3

I propose for now that you: Ensure that remote administration of the RV-042 is actually disabled. Dispute the finding with Trustwave and cite that you have a compensating control, namely, that all connections to those ports are immediately dropped. In the long term you should probably find another router, the software for which is better supported by its ...


3

Medium directionality (L2) and protocol directionality (L5) are independent concepts. I've never seen a L2 switch that included "simplex" in the port configuration, though such a configuration might be possible with security settings. Half and full duplex are only applicable to 10 and 100 Mb connections. 1 and 10GbE are natively full duplex.


3

Your warranty should be tied to the chassis of the server. Just like this, you should never have to give an individual component's serial number for support. This is especially true for a non-serviceable/non-accessible part like a CPU.



Only top voted, non community-wiki answers of a minimum length are eligible