Tag Info

Hot answers tagged

88

Virtual LANs (VLANs) are an abstraction to permit a single physical network to emulate the functionality of multiple parallel physical networks. This is handy because there may be situations where you need the functionality of multiple parallel physical networks but you'd rather not spend the money on buying parallel hardware. I'll be speaking about Ethernet ...


15

TTL is part of the IPv4 protocol (on v6 it is called "Hop Limit", as per Steven Monday's comment). Switches and hubs operate on a different layer of the ISO/OSI model (layer 2 as opposed to layer 3 - there do exist so-called layer 3 switches, but I assume you're not asking about them as you include hubs as well). The TTL field is set by the sender of the ...


15

I found the solution after spending roughly 40 hours on this problem. There is a setting in the switch that enables "Auto DoS" protection. Apparently it considers TCP or UDP traffic that has matching source or destination ports to be a blat attack and drops the packet. This is ridiculously short-sighted since SIP traffic often (always?) relies on source ...


11

We operate a couple network implementations where third-party connections are linked up to a centralized Cisco backbone (i.e. multi-tenant setup). I can say I've seen a bunch of diverse (okay, ghetto) devices connected up to the Catalyst platform, and if there's one thing I've learned, it's that the Cisco platform is remarkably resilient to these kinds of ...


10

An access port sends and receives untagged frames (i.e. all frames are in the same VLAN), while a trunk port supports tagged frames and thus allows to switch multiple VLANs.


8

It's trivial to filter by destination IP address. Routers already switch on header destination IP; you just have to set up a null route for the IP in question. Indeed, this is done on a regular basis for DDoS mitigation.


8

Without STP, yes you would have a loop. Make sure that STP is enabled and configured correctly, though, and you won't need to worry about loops.


7

1) Should you always completely separate the storage network switches from production switches or are VLANs fine to segment this traffic? Is there a golden rule here? There is no golden rule here. Physical switch segregation happens when the storage network demands more features/reliability than the data-network environment can provide. But if the data ...


6

For what it's worth, in my experience, both other answers (Oliver's and Ignacio V-A's) are correct, despite being different. (Edit: I notice that Ignacio has since deleted his answer; the upshot of his answer was that trunk ports were higher-bandwidth-lower-latency ports on a switch, possibly better connected to the backplane, into which I read the ...


6

It's SO easy it's not true, you simply define your vswitches and attach two or more physical NICs to them using the GUI, each NIC is then capable of carrying the traffic from your VMs (which don't need to know that their underlying networks are protected) or the service console. There are a number of load-balancing policies to choose, from a simple failover ...


5

In addition to what others have said, you should actually have two switches for your storage network for redundancy, with multipathing configured so that there's two paths per hypervisor host to your SAN. This configuration (depending on hypervisor, licensing, etc.) also allows for load balancing between paths in addition to high availability.


5

The method you planned will work great. One item I would recommend you research first is if the network card in your five year old ISA server can support VLAN tagging. If it cannot, an alternative would be to install a second network card in the server and plug that into an access port on the testing environment VLAN. One other point to consider is if you ...


5

No it will not unless you setup bridge or forwarding on your server.


5

ARP resolves IP addresses to MAC addresses. Switches don't ARP for traffic sent from one host to another host. As such you wouldn't find an entry for the destination host in the switch's ARP table unless the switch itself is trying to communicate with that destination host. What you're looking for is the switch's MAC address table, which is it's MAC address ...


4

The frame is forwarded out all interfaces except the interface on which it was received. MAC addresses are added to the address table when the switch receives a frame from that address.


4

Switches aren't firewalls, so if you want firewalling you will need to buy a firewall or use a host-based firewall. Don't buy an el-cheapo switch but at least one you can manage remotely (e.g. ssh into its management interface from one of the DB servers).


4

FAB modules go in the front center of the chassis on the 7009. If you go to Cisco's website they have a 3D model where you can click on 'Fabric Module' and it shows you exactly where it is. Or you can just follow this direct link: http://www.cisco.com/assets/swa/vid/nexus7009_kaon/index.html. Cisco does not count fabric modules against the I/O module ...


4

You haven't provided any info about the interfaces you're going to use with the fibre link, so I'm guessing that this is 1gbit. If the switches you're going to use have 1gbit copper interfaces aswell then it's no problem to trunk between them, this is the normal way of connecting switches that have several uplinks. I need to warn you however - if those ...


4

What you propose will work, but is not ideal from a redundancy perspective. You propose this: A better topology that would allow for link or core switch failure would be this (note it only uses two fiber ports in the core, but you have a building-to-building link). Obviously spanning tree of some sort must be enabled on all switches to prevent loops: If ...


4

You don't need trunking at all - the two VLAN's are running on separate cables and you aren't using 802.1q on the Dell side. The same commands you're using on the Dell (switchport access vlan xxx) will work on the Cisco side as well, as the syntax is actually derived from (read: copied) Cisco.


4

I have used the Netgear GS748TP at several sites for VoIP implementations and have had good results with them: http://www.netgear.com/business/products/switches/smart-switches/GS748TP.aspx You have to deal with the web interface to configure it. It is a little clunky. If you can get past it, they are a really decent switch for the price. The bad thing is ...


4

Yes you are asking for trouble. In order to get good performance out of iSCSI, you need to enable jumbo packets on the switch. On the 3560, you're only able to set MTU size for the entire switch, not individual ports. So you'd have to set a higher MTU for the entire network which may lead to more problems that you'll have to deal with. In addition to that ...


3

Generally its best to keep them separate. But that costs more money. But only you can answer if you are overloading the switches. How much of each port being utilized? What is the utilization of the cpu on the switches? Do you have enough to spare capacity to handle peak load? If you're pushing over 90% of the maximums each day, then yes. If you're at ...


3

Separate switches is the best config. That having been said, VLANS can absolutely work just fine. Even if you aren't able to enable jumbo frames because of the issue that Jason Berg mentioned, with just 3 hosts I suspect you will be fine. I would make the point though of actually monitoring those switches to see the impact of the extra traffic so you know if ...


3

In a nutshell, Time To Live was implemented to prevent routing(OSI Layer 3) loops. That is to prevent a packet from hoping forever between the same nodes without ever reaching its destination. So only the nodes that make a routing decision for the packet decrease its TTL by one. When TTL reaches zero then the packet is dropped again only by a device making ...


3

Are there cli tools? You could do something like (I know it's cisco, bear with me): switch>ping 192.168.101.1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.101.1, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms Then search the arp for the IP: switch>show arp | include 101.1 ...


3

I have seen this a number of times and not just with Cisco and HP. We have a wireless radio and a Cisco box that will not auto negotiate. It should work but just does not. Basically, you have the fix... Set the speed and duplex on both the same and away you go. It ususlly seems to be hardware that is somewhat static(servers, routers,etc) so it is set at ...


3

Cisco has some good ones. http://www.cisco.com/web/about/ac50/ac47/2.html They do look 3Dish though, but maybe you'll find some uses for them.


3

You can split a bond across the switches, but not to increase throughput. So if a server has two NICs and you plug one into each Switch, then you'll have to configure the server for some sort of bonding with failover only. This Q/A has a lot of good details: Server-to-Switch Trunking in Procurve switch, what does this mean? The switches have to be plugged ...



Only top voted, non community-wiki answers of a minimum length are eligible