Tag Info

Hot answers tagged

9

Nope. The Cisco RV110W device you have contains a dedicated WAN port. This is a physical hardware port intended for this purpose. You will not be able to reassign WAN functions to one of the four switch ports. More importantly, equipment damaged in an electrical storm really should not be trusted. You're going to have to replace this router.


7

Cisco 2960 switches pull in cool air from the sides and exhaust to the rear. Depth-wise they are 1/3 to 1/2 rack-depth (depending on exact model switch and rack). This leaves you very few options. If you mount them unmodified backside of the rack just about the entire switch is in the hot zone. That will only be OK if you have cold airflow running on the ...


6

VTP is proprietary to Cisco. Juniper implements something similar with GVRP and MVRP (both industry standard protocols). You'll need to look into both of these protocols to determine exactly what you need and how to deploy them though. It's not something that is a quick "everyone can just run this CLI command" thing for these to function properly.


6

Absolutely. In the TACACS configuration, you can restrict the commands you allow, but you would do better to move that logic into a web application, rather than give your customers direct access into the switches. Simply put, you can create very granular access control using TACACS, but it is very easy to screw-up, and keeping the user-> device -> port -> ...


5

The no setup express command disables the functionality that resets the configuration when the MODE button is held. I suspect this will do what you're looking for.


5

As an Information Assurance (IA) principle, the less unnecessary services running on a device, the lower the attack surface. To mitigate issues, proper configuration and patching levels are key. Changing ports is one of many elements you can do to lower the potential security risk. Cisco has an excellent guide for proper implementation of the HTTP/HTTPS ...


4

It appears that someone can't spell phoneproxy correctly when they typed it in setting it up. Regardless it's for CUCM's phone proxy feature on an ASDM firewall. See here: http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/unified_comm_phoneproxy.html Here's the gist of it: The Cisco Phone Proxy on the ASA bridges IP ...


4

Sure, that info's usually in the output of show version , though that might vary with specific devices and software versions.


3

Does your host use a DNS name? If so, ask for DNS rewrite to be enabled on the Cisco ASA NAT rule for your host.


3

Devices in the same subnet don't need router to access each other. Learn networking basics.


3

Please have a look at the following: http://msdn.microsoft.com/en-us/library/azure/jj156075.aspx According to the documentation, assuming all of your network information is correct, you should disable Perfect Forward Secrecy if you are using static routing.


3

what is the difference between inside_access_in and inside_access_out ? Inside_access_in and Inside_access_out are just friendly names for your access lists. In your case, Inside_access_in is an 'Inbound' access-list, and inside_access_out is an 'Outbound' access list. An inbound access-list is applied to traffic as it ENTERS that interface. ...


3

Medium directionality (L2) and protocol directionality (L5) are independent concepts. I've never seen a L2 switch that included "simplex" in the port configuration, though such a configuration might be possible with security settings. Half and full duplex are only applicable to 10 and 100 Mb connections. 1 and 10GbE are natively full duplex.


3

Your warranty should be tied to the chassis of the server. Just like this, you should never have to give an individual component's serial number for support. This is especially true for a non-serviceable/non-accessible part like a CPU.


3

The problem is like this: dmeg says the negotiation is complete but the switch is not ready and the led of the port on the switch is still red and it get a while for it to get green. Your problem seems to be that the switchport isn't configured as a spanning tree edge port. Edge ports are optimized to forward to quickly; otherwise the switch port goes ...


3

I propose for now that you: Ensure that remote administration of the RV-042 is actually disabled. Dispute the finding with Trustwave and cite that you have a compensating control, namely, that all connections to those ports are immediately dropped. In the long term you should probably find another router, the software for which is better supported by its ...


3

Seeing a the route "hop around" on your network is really bizarre. You should see a traffic flow that hops form your edge router through your distribution routers. You definitely shouldn't be seeing traffic being routed through end user Customer addresses / devices. I tend to think you're seeing some kind of artifact of your configuration in these traceroute ...


3

You can login directly in enable mode if your privilege level allows it. I am running asa916-k8.bin on 5510 The command is aaa authorization exec LOCAL auto-enable Ravi L


3

One potential problem with HTTPS is that lazy people (like me) may not set up a Kerberos certificate on the device to ensure that connections to it are secure. Your certificate would have to come from one of 3 sources: a commercial certificate authority like Verisign (expensive), setup your own CA using a Windows or Linux server (not that hard, but time ...


3

As one of the previous answers states, you can use Policy Based Routing and set up a route map on your router. However, instead of using VLANs or Static IPs, you could use QoS Marking instead. This could be rolled out in a group policy to your Windows PCs, and the route map on your router could be configured to look out for a particular DSCP value to ...


3

Q: Can layer 2 switch ports be configured as VLAN trunk ports? A: Most certainly. VLAN's are a Layer 2 construct. Q: Do I have to set both ends of the trunk as a trunk? A: Yes. A few things to note: You need to make sure that both sides of the trunk have the encapsulation configured as 802.1Q. I can't give you specifics on how to configure the trunk on ...


3

With the strict hot/cold setup it seems like even if the airflow could be reversed leaving the switches at the back of the racks would have a negative impact since they would be sucking in air from the hot aisle in the datacenter. Based on the diagrams of the switch that I can see online it is not a full depth switch, so when mounted on the back side of the ...


2

I'd use real or observed numbers... Likely 400 Watts per server (assuming sane RAM and disk configurations) and ~380 Watts for the switch. This is based on experience with the equipment in production and working in and around data centers. Plan for expansion and growth as well.


2

I would use 'debug ip packet' and trace the ICMP packets at the time you send the bursts. That would give you an idea of what was happening. More info here: Cisco Debugging And, I'll reprint the warnings from that site here: Enabling debugging can disrupt operation of the router when internetworks are experiencing high load conditions. Hence, if logging ...


2

By default there is no limitation on the status of the ports. They should be administratively enabled by default. Additional thoughts: Check that the ports are not administratively disabled (show int x/y). Verify that the SFP on both sides are the same (multimode/singlemode of the same type/wavelength) Ensure that switch to switch connection is allowed ...


2

If you want it to learn a new MAC and make it sticky you'll to remove the old one: no switchport port-security mac-address mac_address in the relevant interface. The docs here have some useful info but you might want to consult the docs your specific IOS version.


2

In your situation I would simply use the ASA as a DHCP that hands out its internal IP as the DNS server, use DNS proxy to the tunnel DNS and have several public DNS's listed in the config. EG. (these commands work on c3900 equipment ios15.1, you may have to make changes to be compatible to the ASA software) service dhcp ip domain nameserver "tunnel dns" ip ...


2

ip address 10.10.0.1 255.255.255.0 Your router will not be able to reply to the data it's being sent, because it itself is restricted to the original /24. Change this to ip address 10.10.0.1 255.255.252.0


2

You should use a router as a terminal server - that is the most appropriate and common way of accomplishing what you're attempting to do. Buy this part #: CISCO2901-16TS/K9 (includes the router, the HWIC card, and the cables) Here's a forum post where some configuration advice is given: ...



Only top voted, non community-wiki answers of a minimum length are eligible