Tag Info

Hot answers tagged

9

Nope. The Cisco RV110W device you have contains a dedicated WAN port. This is a physical hardware port intended for this purpose. You will not be able to reassign WAN functions to one of the four switch ports. More importantly, equipment damaged in an electrical storm really should not be trusted. You're going to have to replace this router.


6

VTP is proprietary to Cisco. Juniper implements something similar with GVRP and MVRP (both industry standard protocols). You'll need to look into both of these protocols to determine exactly what you need and how to deploy them though. It's not something that is a quick "everyone can just run this CLI command" thing for these to function properly.


6

Absolutely. In the TACACS configuration, you can restrict the commands you allow, but you would do better to move that logic into a web application, rather than give your customers direct access into the switches. Simply put, you can create very granular access control using TACACS, but it is very easy to screw-up, and keeping the user-> device -> port -> ...


5

The no setup express command disables the functionality that resets the configuration when the MODE button is held. I suspect this will do what you're looking for.


5

As an Information Assurance (IA) principle, the less unnecessary services running on a device, the lower the attack surface. To mitigate issues, proper configuration and patching levels are key. Changing ports is one of many elements you can do to lower the potential security risk. Cisco has an excellent guide for proper implementation of the HTTP/HTTPS ...


5

Cisco 2960 switches pull in cool air from the sides and exhaust to the rear. Depth-wise they are 1/3 to 1/2 rack-depth (depending on exact model switch and rack). This leaves you very few options. If you mount them unmodified backside of the rack just about the entire switch is in the hot zone. That will only be OK if you have cold airflow running on the ...


4

It appears that someone can't spell phoneproxy correctly when they typed it in setting it up. Regardless it's for CUCM's phone proxy feature on an ASDM firewall. See here: http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/unified_comm_phoneproxy.html Here's the gist of it: The Cisco Phone Proxy on the ASA bridges IP ...


4

Sure, that info's usually in the output of show version , though that might vary with specific devices and software versions.


3

Medium directionality (L2) and protocol directionality (L5) are independent concepts. I've never seen a L2 switch that included "simplex" in the port configuration, though such a configuration might be possible with security settings. Half and full duplex are only applicable to 10 and 100 Mb connections. 1 and 10GbE are natively full duplex.


3

Your warranty should be tied to the chassis of the server. Just like this, you should never have to give an individual component's serial number for support. This is especially true for a non-serviceable/non-accessible part like a CPU.


3

I propose for now that you: Ensure that remote administration of the RV-042 is actually disabled. Dispute the finding with Trustwave and cite that you have a compensating control, namely, that all connections to those ports are immediately dropped. In the long term you should probably find another router, the software for which is better supported by its ...


3

Seeing a the route "hop around" on your network is really bizarre. You should see a traffic flow that hops form your edge router through your distribution routers. You definitely shouldn't be seeing traffic being routed through end user Customer addresses / devices. I tend to think you're seeing some kind of artifact of your configuration in these traceroute ...


3

The problem is like this: dmeg says the negotiation is complete but the switch is not ready and the led of the port on the switch is still red and it get a while for it to get green. Your problem seems to be that the switchport isn't configured as a spanning tree edge port. Edge ports are optimized to forward to quickly; otherwise the switch port goes ...


3

Please have a look at the following: http://msdn.microsoft.com/en-us/library/azure/jj156075.aspx According to the documentation, assuming all of your network information is correct, you should disable Perfect Forward Secrecy if you are using static routing.


3

what is the difference between inside_access_in and inside_access_out ? Inside_access_in and Inside_access_out are just friendly names for your access lists. In your case, Inside_access_in is an 'Inbound' access-list, and inside_access_out is an 'Outbound' access list. An inbound access-list is applied to traffic as it ENTERS that interface. ...


3

You can login directly in enable mode if your privilege level allows it. I am running asa916-k8.bin on 5510 The command is aaa authorization exec LOCAL auto-enable Ravi L


3

BT have said they cannot site the 2921 anywhere else than this telecoms cupboard. The 2921 is not wall mountable and we have no additional room for another rack cabinet in the cupboard. Actually the Cisco 2921 is wall mountable. Please consider using a wall mount if you have space for it. I have concerns over the airflow (there is very little) and ...


3

Cisco ASA firewalls all support SSL VPN. Depending on the edition and version of the firewall (Cisco ASA 5505, 5510, 5520, etc.), there's a limit to the number of simultaneous SSL VPN users that can connect. Please see this Cisco licensing reference guide. Please find out which version of Cisco ASA firewall you have. RAM for Cisco firewalls is ...


3

Does your host use a DNS name? If so, ask for DNS rewrite to be enabled on the Cisco ASA NAT rule for your host.


3

Devices in the same subnet don't need router to access each other. Learn networking basics.


3

One potential problem with HTTPS is that lazy people (like me) may not set up a Kerberos certificate on the device to ensure that connections to it are secure. Your certificate would have to come from one of 3 sources: a commercial certificate authority like Verisign (expensive), setup your own CA using a Windows or Linux server (not that hard, but time ...


3

As one of the previous answers states, you can use Policy Based Routing and set up a route map on your router. However, instead of using VLANs or Static IPs, you could use QoS Marking instead. This could be rolled out in a group policy to your Windows PCs, and the route map on your router could be configured to look out for a particular DSCP value to ...


3

Q: Can layer 2 switch ports be configured as VLAN trunk ports? A: Most certainly. VLAN's are a Layer 2 construct. Q: Do I have to set both ends of the trunk as a trunk? A: Yes. A few things to note: You need to make sure that both sides of the trunk have the encapsulation configured as 802.1Q. I can't give you specifics on how to configure the trunk on ...


2

I'd use real or observed numbers... Likely 400 Watts per server (assuming sane RAM and disk configurations) and ~380 Watts for the switch. This is based on experience with the equipment in production and working in and around data centers. Plan for expansion and growth as well.


2

I would use 'debug ip packet' and trace the ICMP packets at the time you send the bursts. That would give you an idea of what was happening. More info here: Cisco Debugging And, I'll reprint the warnings from that site here: Enabling debugging can disrupt operation of the router when internetworks are experiencing high load conditions. Hence, if logging ...


2

If you want it to learn a new MAC and make it sticky you'll to remove the old one: no switchport port-security mac-address mac_address in the relevant interface. The docs here have some useful info but you might want to consult the docs your specific IOS version.


2

In your situation I would simply use the ASA as a DHCP that hands out its internal IP as the DNS server, use DNS proxy to the tunnel DNS and have several public DNS's listed in the config. EG. (these commands work on c3900 equipment ios15.1, you may have to make changes to be compatible to the ASA software) service dhcp ip domain nameserver "tunnel dns" ip ...


2

I recently wrote an Ansible module that allows you to use SSH+SCP to transfer a file to Cisco IOS devices. One of the use cases is obviously transferring IOS images. It has some built-in checks like not transferring the file if it already exists and performing an MD5 comparison (original file to transferred file). The MD5 is CPU intensive on the router, ...


2

Enabling HTTPS and changing the port number is actually very common practice. Using a secure password for the login will also increase the security. Of course, you should always use HTTPS over HTTP. But ultimately to answer your question, no it's not insecure. The web management interface is just a user friendly way to configure the settings, but if ...



Only top voted, non community-wiki answers of a minimum length are eligible