Tag Info

Hot answers tagged

14

The way that we deal with this is to create an separate object group for interface that we want to have redundant connectivity to, it is a little messy but it should work for what you need. So you would have a FIOS object object network FIOS_NYHQ_GUESTWIRELESS_10.110.6.0_24 nat (NYHQ-GUESTWIRELESS,NYHQ-OUTSIDE_FIOS) dynamic interface and a Cogent ...


10

You don't prevent MAC spoofing, since it's entirely client-side. This is the reason that no one that really cares about security is using MAC whitelisting or blacklisting. If you care about controlling what devices connect to your network, you should be using 802.1x with device certificates issued by your own internal CA that you control, or with some form ...


9

Many network devices use the Yost RJ45 pinout for RS-232 console communications. Cisco is probably the best known, but certainly not the only. The switch should have come with a DB9 to RJ45 blue cable. You can just pickup any USB-DB9 Serial adapter (though I highly recommend getting one with a Prolific PL2303HX Rev D Chipset, as they "just work" and are ...


6

You should enable portfast on any desktop/phone-port, but only if you have rapid spanning tree configured across your switch network to ensure that loops doesn't kill the network longer than needed. Regarding trunk (yes, trunk - not truck) ports - On Cisco switches you configure the port to run in access mode, but with a voice vlan added. This is much ...


6

The standard approach is to use a USB-to-serial adapter and a (Cisco) console cable to perform the initial configuration. Basically, the state of your current switch is unknown. Is it new from a factory, refurbished, used? Either way, there's no guarantee on how the switch was configured and what's on the unit. For example, I've had Cisco ASA firewalls ...


6

There are performance characteristics set forth by TIA/EIA 568 for "connecting hardware" like jacks, etc. Looking at the differences just between 5e and 6 (not 6a) connectors below, you can see the difference in mhz supported, loss, etc. Only being an admin, and not an EE, I can't tell you what this means in terms of real world performance or acceptable ...


6

My fix for a switch like that would be to replace it. If still under warranty send it back to Cisco, otherwise eat the loss and buy a new one. Why? Clearly something is broken when you get malformed packets. That shouldn't happen. And you should be able to factory-reset the equipment. A switch which starts to act up can cause nightmarish network ...


6

You can't map a port on a public IP address to more than one private IP address, it just won't work because how is the router supposed to know which one to go to? If you're using name-based virtual hosts, you could achieve this by sitting a HAProxy instance in-front of the web instances and direct all traffic from the router to the HAProxy instance. On the ...


5

ARP / Broadcast storm We see large broadcast packets from VLAN 1, VLAN 1 used for desktop devices. We use 192.168.0.0/20 ... Wiresharks shows that 100s of computers are flooding the network with ARP Broadcast ... Your ARP Input process is high, which means the switch is spending a lot of time processing ARPs. One very common cause of ARP ...


5

There isn't really a solution, from a file compression standpoint, that you can use. The router's bootloader decompresses the IOS image and, since you can't alter the bootloader adding support for new compression algorithms isn't possible. Having an out-of-band management connection would the best techncal means to safely handle these situations. In the ...


5

You need to consider, in detail, how traffic will flow in your network. Determine the bandwidth requirements for things like access to intranet sites and file servers, as well as internet access. This will guide you toward how you can plan your core infrastructure so that groups of workstations have adequate bandwidth in the directions they will send ...


5

I can understand your confusion -- it stems from Cisco using its own terminology in a somewhat inconsistent way. In the case of the 7600 series (and most of Cisco's high-end gear) you have a chassis and modules. The modules that you put into a 7600 series chassis can be routing modules, switching modules, or service modules -- It's a flexible system. So ...


5

Cisco switches puts ICMP at the bottom of the priority list. We get the same results if we ping a busy 3750-X. You need to look at the system utilization on the switches, as I suspect they are so busy that they are doing software processing of packets. Are you running any kind of layer 3 services on these? There is a quite serious bug in IOS 12.2.53: ...


4

Heres the best way I can explain it: enable password uses no encryption at all, so this is obviously not recommended. enable secret uses MD5 to hash the password, so you do not have to worry about the enable password being stored in clear text. If your cisco device supports it, then use it. service password-encryption encrypts all other passwords such as ...


4

The router is correct, because with that subnet mask those addresses do overlap. 192.168.2.1/21, which is what your command tries to configure, is part of a subnet that includes everything from 192.168.1.1 through 192.168.7.255. What you mean to configure is 192.168.2.1/24 which is a mask of 255.255.255.0. You may find it useful to use a subnet calculator ...


4

I'm wondering if the internet speeds have something to do with the VPN's bad performance.> You mean outside the following: The internet speed for SC are: Download:50 Mbps Upload: 4 Mpbs, Where you say yourself you are limited to 4mbps upload from there. OBVIOUSLY you only can get the smallest speed of any element. So, getting data out of SC will ...


4

Solved. The issue is with SCCM 2012 SP1, a service called: ConfigMrg Wake-Up Proxy. The 'feature' does not existing SCCM 2012 RTM. Within 4 hours of turning this off within the policy, we saw steady drops in CPU usage. By the time 4 hours was up, ARP usage was merely 1-2%! In summary, this service does MAC address spoofing! Cannot believe how much havoc ...


4

The support is mixed. Some devices support both, some only one and some again, neither (IOS-XR, which is a bit short-sided on their part). It is really up to the business units (sadly). That being said, I find that 90% of the customers and vendors out there still use RFC 3164. RFC 5424 might be considered "better" since it makes events easier to parse on ...


4

Any thoughts? Don't do this. Either configure a client-based VPN connection for each host that you want to connect with, or configure a site-to-site VPN and bridge both sites in question. Windows 7 was not ever intended to be used the way that you're describing.


4

I'm sorry. I'm really really sorry, but if you have the AIR-CAP2602-I.. then it's only suitable for lightweight AP mode, and requires a controller. You have two options.. you can go back to your reseller, chew them out for not spotting that you'd need a controller when you bought it.. and get them to exchange them for AIR-SAP2602-I versions you can go ...


4

There are long-haul fiber (and copper) cables all over the world (over land and under oceans). There are also satellite links and terrestrial wireless networks. The bits have to flow over some media. That doesn't mean that a provider needs to own the media, however. Many ISPs lease access to media when it isn't economical or feasible to use media they own. ...


3

The crypto logging session command is about the best you're going to get. It was introduced in IOS 12.3(4)T. This will cause tunnel up/down events to be logged in the form: %CRYPTO-5-SESSION_STATUS: Crypto tunnel is UP . Peer 10.0.0.1:500 Id: 10.0.0.1 %CRYPTO-5-SESSION_STATUS: Crypto tunnel is DOWN. Peer 10.0.0.1:500 Id: 10.0.0.1 There's ...


3

I'm going to preface this answer (that I already typed out, and am thus, not going to delete) by saying that it looks like your router uses the term "static DHCP" for what the rest of the world calls a "DHCP reservation." So, in fact, the proper configuration of your device is to have your DHCP pool set from 192.168.0.2 to 192.168.0.254, and then to put all ...


3

No special hardware modules are required. As long as you have a K9 image with IPsec support, you can establish an IPsec tunnel. However, the crypto transforms are CPU-intensive, so router performance may suffer without dedicated hardware. Whether you need it really depends on what you're doing with the router. On the 2600XM series, hardware VPN acceleration ...


3

You need to have equivalent networking on both sides of the vMotion transfer. If the guest arrives on the new host and the requisite VLANs aren't present, it will lose its networking... That's exactly what you're describing. Try to identify the VLANs needed by your VM and add them to the other hosts.


3

Use the password recovery method explained here, but instead of recovering the password, delete the startup configuration. http://www.cisco.com/en/US/docs/routers/access/800/850/software/configuration/guide/857sg_bk.pdf


3

Datagrams are a best effort service. If you have a requirement that data be reliably delivered, you cannot use datagrams It really is that simple. The entire design of the system, end to end, is not meant to meet this requirements. You can't just impose it on the system as a whole at the end like putting a cherry on a sundae.


3

According to the spec sheet: http://www.cisco.com/en/US/prod/collateral/ps10265/ps10493/C220M3_SFF_SpecSheet.pdf you can simply plug it into the 220 pdu if you have one, just need the right power cord (found here on the same spec sheet): http://www.cisco.com/en/US/prod/collateral/ps10265/ps10493/C220M3_SFF_SpecSheet.pdf


3

The switch is up and running. It does not need ip address settings nor does it need to be able to ping any other host for it to function as a layer 2 switch, which is what it is. Assigning an ip address to the VLAN1 interface allows you to manage the switch by connecting to that ip address, nothing more. It has no bearing on it's functionality as a layer 2 ...



Only top voted, non community-wiki answers of a minimum length are eligible