The Cisco Short Questions Thread v12.4.9(WTF)

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cisco Short Questions Thread v12.4.9(WTF)

«‹›431 »

ragzilla: Sep 9, 2005; don't ask me, i only work here

zalmoxes posted:

I'm probably getting ahead of myself, but I'm just studying for the CCNA and wanted to know what happens to UDP traffic in a setup with load-ballancing? UDP doesn't offer any sort of error-recovery or reordering of packets, so if the traffic gets load ballanced over unequal links, how come it doesn't become scrambled on the other end?

Usually the application will use a sequence number and buffer/reorder (see jitter buffers common in RTP applications), or the data exchanged is small enough that it only uses a single datagram.

# ? Jul 21, 2012 16:29

Adbot: ADBOT LOVES YOU

# ? May 31, 2024 06:13

Jelmylicious: Dec 6, 2007; Buy Dr. Quack's miracle juice! Now with patented H-twenty!

This is also why voice and video use RTP on top of UDP: http://en.wikipedia.org/wiki/Real-time_Transport_Protocol

e:fb

# ? Jul 21, 2012 17:00

Ninja Rope: Oct 22, 2005; Wee.

zalmoxes posted:

I'm probably getting ahead of myself, but I'm just studying for the CCNA and wanted to know what happens to UDP traffic in a setup with load-ballancing? UDP doesn't offer any sort of error-recovery or reordering of packets, so if the traffic gets load ballanced over unequal links, how come it doesn't become scrambled on the other end?

Regarding LACP, I think it's the Ethernet standard that says devices should avoid re-ordering packets whenever possible. That's part of the reason LACP doesn't scale exactly with the number of links added. LACP uses a hash algorithm to determine which link an outgoing packet will be sent over, and that hash algorithm is designed to keep a single flow on the same link, even if that results in unused capacity. There are multiple algorithm choices on some platforms but they're all based around how you determine what a flow is.

In general, though, you can set up some kind of hosed up load balancing scenario that causes packets to be delivered out of order, and in the case of UDP (or any protocol that doesn't build in retransmits and reordering) it is possible for lost data or delayed data to cause problems. So don't do that!

# ? Jul 21, 2012 22:43

lilcasino: Jun 4, 2001

Anyone recommend a Cisco router for our new fiber connection? We're going from bonded T's to a fiber ethernet hand off. The only "weird" part the ISP is giving me one subnet for the router and another subnet for our internal IP's

# ? Jul 23, 2012 15:07

falz: Jan 29, 2005; 01100110 01100001 01101100 01111010

lilcasino posted:

Anyone recommend a Cisco router for our new fiber connection? We're going from bonded T's to a fiber ethernet hand off. The only "weird" part the ISP is giving me one subnet for the router and another subnet for our internal IP's

What speed and type of media is the handoff? What features do you need (Nat?) Also using a link net to route your block is nice since it will give you more usable IPs.

# ? Jul 23, 2012 15:17

lilcasino: Jun 4, 2001

falz posted:

What speed and type of media is the handoff? What features do you need (Nat?) Also using a link net to route your block is nice since it will give you more usable IPs.

Fairpoint has us a 10m right now but it is scalable to 100 if we need it. It is a straight RJ45 ethernet hand off. We average around 2500 connections at one time. I don't need the Cisco to do NAT my firewall would do that.

# ? Jul 23, 2012 16:06

ate shit on live tv: Feb 15, 2004; by Azathoth

Depending on the features you need (Wireless etc) you can get away with a simple 888 or 1800.

# ? Jul 23, 2012 16:09

ragzilla: Sep 9, 2005; don't ask me, i only work here

lilcasino posted:

Fairpoint has us a 10m right now but it is scalable to 100 if we need it. It is a straight RJ45 ethernet hand off. We average around 2500 connections at one time. I don't need the Cisco to do NAT my firewall would do that.

Why do you want/need a router? If they're going to hand off Ethernet why not take it direct into your firewall, unless you have a need for something in a DMZ outside the firewall?

# ? Jul 23, 2012 16:30

lilcasino: Jun 4, 2001

ragzilla posted:

Why do you want/need a router? If they're going to hand off Ethernet why not take it direct into your firewall, unless you have a need for something in a DMZ outside the firewall?

Fairpoint has given us a /52 for our router then a /40. I believe the only way I can route the /40 with our firewall is to use ARP and create static routes for each address. Wouldn't it be easier to configure and maintain to have a router on the /52 and then pass the /40 subnet? Or am I over or not thinking.

# ? Jul 23, 2012 16:45

Ginger Beer Belly: Aug 18, 2010; Grimey Drawer

lilcasino posted:

Fairpoint has given us a /52 for our router then a /40. I believe the only way I can route the /40 with our firewall is to use ARP and create static routes for each address. Wouldn't it be easier to configure and maintain to have a router on the /52 and then pass the /40 subnet? Or am I over or not thinking.

Do you mean a 255.255.255.252 mask subnet and then a 255.255.255.240 mask subnet?

You may want to check out http://www.subnet-calculator.com/cidr.php

What is your firewall?

# ? Jul 23, 2012 17:02

Tasty Wheat: Jul 18, 2012

Ninja Rope posted:

Regarding LACP, I think it's the Ethernet standard that says devices should avoid re-ordering packets whenever possible. That's part of the reason LACP doesn't scale exactly with the number of links added. LACP uses a hash algorithm to determine which link an outgoing packet will be sent over, and that hash algorithm is designed to keep a single flow on the same link, even if that results in unused capacity. There are multiple algorithm choices on some platforms but they're all based around how you determine what a flow is.

In general, though, you can set up some kind of hosed up load balancing scenario that causes packets to be delivered out of order, and in the case of UDP (or any protocol that doesn't build in retransmits and reordering) it is possible for lost data or delayed data to cause problems. So don't do that!

At least from the WAN side going in, voice can get really jacked up if you just load balance everything without regard to the type of traffic. TCP works just fine, even when your setup is 2 3.8m VSATs connected by 1km of SM, voice not so much.

# ? Jul 23, 2012 17:04

falz: Jan 29, 2005; 01100110 01100001 01101100 01111010

lilcasino posted:

Fairpoint has given us a /52 for our router then a /40. I believe the only way I can route the /40 with our firewall is to use ARP and create static routes for each address. Wouldn't it be easier to configure and maintain to have a router on the /52 and then pass the /40 subnet? Or am I over or not thinking.

I don't see why a firewall couldn't do a /30 on one ethernet interface and your /29 or whatever inside. What type of firewall is it?

# ? Jul 23, 2012 17:30

Sir Sidney Poitier: Aug 14, 2006; My favourite actor

lilcasino posted:

Anyone recommend a Cisco router for our new fiber connection? We're going from bonded T's to a fiber ethernet hand off. The only "weird" part the ISP is giving me one subnet for the router and another subnet for our internal IP's

It's probably overkill, but this is the setup we have for our leased line customers who have a fibre for the main connection, then ADSL as backup. We send out a 1941 for it with an HWIC1-ADSL or whatever it is. This then speaks BGP with our PE and advertises the customer network over both, but lower pref on the ADSL.

# ? Jul 23, 2012 17:48

ragzilla: Sep 9, 2005; don't ask me, i only work here

falz posted:

I don't see why a firewall couldn't do a /30 on one ethernet interface and your /29 or whatever inside. What type of firewall is it?

Typically I'd do /30 on the outside (presumably the provider has the /29 routed to the customer side of the /30) and all RFC1918 on the inside, then you can use all 8 IPs of the /29 for translations.

# ? Jul 23, 2012 19:47

brent78: Jun 23, 2004; I killed your cat, you druggie bitch.

Cisco 2911/K9 (C2900-UNIVERSALK9-M), Version 15.1(4)M4, RELEASE SOFTWARE (fc1)

Shouldn't this be supported?

code:

(config)#ip urlfilter server vendor websense 172.16.4.12 timeout 8 retransmit 6
                        ^
% Invalid input detected at '^' marker.

# ? Jul 24, 2012 03:28

ragzilla: Sep 9, 2005; don't ask me, i only work here

brent78 posted:

Cisco 2911/K9 (C2900-UNIVERSALK9-M), Version 15.1(4)M4, RELEASE SOFTWARE (fc1)

Shouldn't this be supported?
code:
(config)#ip urlfilter server vendor websense 172.16.4.12 timeout 8 retransmit 6
                        ^
% Invalid input detected at '^' marker.

Does urlfilter require security license/image?

# ? Jul 24, 2012 04:17

ToG: Feb 17, 2007; Rory Gallagher Wannabe

I have a question regarding NAT.

I currently have two networks

10.200.0.0/24 which is for my Cisco/Virtual stuff
192.168.1.0/24 which is my home network.

I currently have internet access via the home network. I have a Cisco 2621XM sitting on both networks and am using NAT overload to get internet access for the cisco/virtual stuff.

This works perfectly at the minute, but I'd like to forward a port on the home network to a virtual machine and vice versa. The home router can ONLY do port forwarding.

Whenever I create a static PAT for the port I want to the virtual machine, The virtual machine loses it's internet connection, is there a way to forward this port as well as having NAT overload in place?

edit: I'm using the command:

ip nat outside source static tcp 192.168.1.1 PORT 10.200.0.110 PORT extendable

edit2: Relevant config in place

code:

!
interface FastEthernet0/0
 description ## INTERNET ##
 ip address 192.168.1.1 255.255.255.0
 ip nat outside
 ip virtual-reassembly
 speed 100
 full-duplex
!
interface FastEthernet0/1
 no ip address
 ip nat inside
 ip virtual-reassembly
 speed 100
 full-duplex
!
interface FastEthernet0/1.30
 encapsulation dot1Q 30
 ip address 10.200.0.97 255.255.255.224
 ip nat inside
 ip virtual-reassembly

ip route 0.0.0.0 0.0.0.0 FastEthernet0/0 192.168.1.254 name HomeRouter
!
ip nat inside source list 1 interface FastEthernet0/0 overload
!
access-list 1 permit 10.200.0.96 0.0.0.31
!

ToG fucked around with this message at 08:53 on Jul 24, 2012

# ? Jul 24, 2012 07:07

Sepist: Dec 26, 2005; FUCK BITCHES, ROUTE PACKETS; Gravy Boat 2k

Change

ip nat outside source static tcp 192.168.1.1 PORT 10.200.0.110 PORT extendable

to

ip nat inside source static tcp 192.168.1.1 PORT 10.200.0.110 PORT extendable

# ? Jul 24, 2012 14:19

ToG: Feb 17, 2007; Rory Gallagher Wannabe

Sepist posted:

Change

ip nat outside source static tcp 192.168.1.1 PORT 10.200.0.110 PORT extendable

to

ip nat inside source static tcp 192.168.1.1 PORT 10.200.0.110 PORT extendable

Sorry, I had meant that I just transposed it wrong. Doing that cuts off the internet connection to the virtual machine too

# ? Jul 24, 2012 15:16

Sepist: Dec 26, 2005; FUCK BITCHES, ROUTE PACKETS; Gravy Boat 2k

Ah, noticed the inside IP should be the first with the interface being the second.

ip nat inside source static tcp 10.200.0.110 PORT interface FastEthernet0/0 PORT

# ? Jul 24, 2012 15:21

falz: Jan 29, 2005; 01100110 01100001 01101100 01111010

ragzilla posted:

Does urlfilter require security license/image?

Probably. http://www.cisco.com/en/US/prod/collateral/modules/ps10598/ordering_guide_c07_557736_ps10536_Products_Data_Sheet.html#wp9000806

# ? Jul 24, 2012 15:22

ToG: Feb 17, 2007; Rory Gallagher Wannabe

Sepist posted:

Ah, noticed the inside IP should be the first with the interface being the second.

ip nat inside source static tcp 10.200.0.110 PORT interface FastEthernet0/0 PORT

drat, How'd I miss that, I configured the nat overload like a day ago. Thanks

. Will test it when I get a chance.

edit: Tested and it performs perfectly. Thanks again.

ToG fucked around with this message at 15:23 on Jul 25, 2012

# ? Jul 24, 2012 17:19

Sir Sidney Poitier: Aug 14, 2006; My favourite actor

If you try and advertise a prefix to a peer, but the peer doesn't allow it due to a prefix filter, will "show ip bgp neighbor X.X.X.X advertised-routes" show the prefix? Or does it only show those which are accepted?

# ? Jul 26, 2012 18:47

Ginger Beer Belly: Aug 18, 2010; Grimey Drawer

Anjow posted:

If you try and advertise a prefix to a peer, but the peer doesn't allow it due to a prefix filter, will "show ip bgp neighbor X.X.X.X advertised-routes" show the prefix? Or does it only show those which are accepted?

It will show up.

If you have access to the peer, you can look at "sh ip bgp neigh X.X.X.X received-routes" and compare it to "sh ip bgp neigh X.X.X.X routes" to see what was advertised vs what was accepted and installed.

# ? Jul 26, 2012 19:11

zalmoxes: Sep 30, 2009

I use a NM-16A module on a router to console into other routers and switches

code:

 
RC3745#show run | inc ip host
ip host sw1 2129 192.168.10.10
ip host sw2 2130 192.168.10.10
ip host sw3 2131 192.168.10.10

I'm having several issues with this. First of all, if I reboot everything and want to telnet into a switch from the router, it doesn't work. until I clear the line and try again. Then I get a lot of garbled output, I'm assuming the console cable is transmitting on all the lines at the same time? I'm not sure how to fix this.

Here is how it looks.

code:

RC3745#sw2
Translating "sw2"
Trying sw2 (192.168.10.10, 2130)...
% Connection refused by remote host

RC3745#clear line 130
[confirm]
 [OK]  
RC3745#sw2
Translating "sw2"
Trying sw2 (192.168.10.10, 2130)... Open        $own command or computer name, 
or unable to find computer address

sw2>$known command or computer name, or unable t$known command or computer name, 
^ or unable to find computer address   

% Invalid input detected at '^' marker.

sw2>

zalmoxes fucked around with this message at 20:16 on Jul 26, 2012

# ? Jul 26, 2012 20:13

Tasty Wheat: Jul 18, 2012

zalmoxes posted:

I use a NM-16A module on a router to console into other routers and switches
code:
 
RC3745#show run | inc ip host
ip host sw1 2129 192.168.10.10
ip host sw2 2130 192.168.10.10
ip host sw3 2131 192.168.10.10
I'm having several issues with this. First of all, if I reboot everything and want to telnet into a switch from the router, it doesn't work. until I clear the line and try again. Then I get a lot of garbled output, I'm assuming the console cable is transmitting on all the lines at the same time? I'm not sure how to fix this.

Here is how it looks.
code:
RC3745#sw2
Translating "sw2"
Trying sw2 (192.168.10.10, 2130)...
% Connection refused by remote host

RC3745#clear line 130
[confirm]
 [OK]  
RC3745#sw2
Translating "sw2"
Trying sw2 (192.168.10.10, 2130)... Open        $own command or computer name, 
or unable to find computer address has bee

sw2>$known command or computer name, or unable t$known command or computer name, 
^ or unable to find computer address   

% Invalid input detected at '^' marker.

sw2>   

I have both a AS2511-RJ and NM-32A, my personal experience has been the same, being that I am lazy, I just copy and paste out of a text file all the clear line commands.

# ? Jul 26, 2012 21:17

Sepist: Dec 26, 2005; FUCK BITCHES, ROUTE PACKETS; Gravy Boat 2k

Ginger Beer Belly posted:

It will show up.

If you have access to the peer, you can look at "sh ip bgp neigh X.X.X.X received-routes" and compare it to "sh ip bgp neigh X.X.X.X routes" to see what was advertised vs what was accepted and installed.

Caveat emptor, received-routes only works if soft-configuration is enabled for the peer.

# ? Jul 27, 2012 21:49

Ridge: Feb 22, 2004; it's a tarp

lol internet. posted:

Quick question, for Cisco ASA. Does anyone use the CLI to configure\manage access rules? Or is everyone using the ASDM?

I use ASDM sometimes for debugging, but that's it. Once I used ASDM to create a VPN and some access rules. I was not impressed with the mess it dumped in the config.

# ? Jul 29, 2012 04:35

zalmoxes: Sep 30, 2009

quote:

All Catalyst multilayer switches support the following types of layer 3 interfaces:

Routed port � a pure layer 3 port similar to that on a router
Switch virtual interface (SVI) � virtual routed VLAN interface for inter-VLAN routing
Bridge virtual interface (BVI) � a layer 3 bridging interface

I understand what an SVI is, but what is the difference between a 'routed port' and a 'BVI' on a Catalyst L3 switch.

When I want to communicate with a router on L3 I type in
int fa0/0
no switchport
ip address xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx

and I have a routed port.

When I need a Vlan Interface, I type in
int Vlan20
ip address xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx

and I create a SVI

What is a BVI?

# ? Jul 31, 2012 00:15

BurgerQuest: Mar 17, 2009; by Jeffrey of YOSPOS

zalmoxes posted:

I understand what an SVI is, but what is the difference between a 'routed port' and a 'BVI' on a Catalyst L3 switch.

When I want to communicate with a router on L3 I type in
int fa0/0
no switchport
ip address xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx

and I have a routed port.

When I need a Vlan Interface, I type in
int Vlan20
ip address xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx

and I create a SVI

What is a BVI?

I've never used it but this seemed to explain it ok to me:

http://www.cisco.com/en/US/tech/tk389/tk815/technologies_tech_note09186a0080094663.shtml

Basically it lets you provide a virtual interface that exists within a bridge-group of 2 or more routed ports.

It seems BVI is not really used anymore in favour of SVI, as I don't think there's any advantage in using routed ports in this fashion over VLAN/SVI? It essentially turns a router working like a switch, except split into bridge-groups instead of VLANs.

BurgerQuest fucked around with this message at 03:33 on Jul 31, 2012

# ? Jul 31, 2012 03:30

FatCow: Apr 22, 2002; I MAP THE FUCK OUT OF PEOPLE

It's used to make a router appear somewhat switch like. You don't get SVIs in router land.

# ? Jul 31, 2012 03:59

CrazyLittle: Sep 11, 2001; Clapping Larry

SVI's don't do traffic shaping, from what I've encountered.

# ? Jul 31, 2012 04:00

ate shit on live tv: Feb 15, 2004; by Azathoth

SVIs are also virtual ports, whereas a Routed port is physical, meaning it his the L3 ASICs.

EIGRP recovers faster over a pair of Routed Ports rather than an SVI. Also QoS/Shaping.

http://packetlife.net/blog/2011/jan/24/convergence-delays-svi-vs-routed-interface/

# ? Jul 31, 2012 15:24

ragzilla: Sep 9, 2005; don't ask me, i only work here

Powercrazy posted:

SVIs are also virtual ports, whereas a Routed port is physical, meaning it his the L3 ASICs.

EIGRP recovers faster over a pair of Routed Ports rather than an SVI. Also QoS/Shaping.

http://packetlife.net/blog/2011/jan/24/convergence-delays-svi-vs-routed-interface/

internally there's no difference between a routed port and terminating on SVI, the routed port will assign an internal VLAN and it just hides the SVI. The one speed up you do get is that it skips checking if there are any other ports in the VLAN up before signaling the SVI to go down if you use a routed interface since it knows there's only 1 port in the VLAN.

# ? Jul 31, 2012 17:49

Gap In The Tooth: Aug 16, 2004

Never done voice before, but now have two 7940 IP phones.

My understanding is if I put the voice version of the IOS on my 2620 router, and then get a copy of UCM Express and put it on the router I should be able to get the phones to talk to each other given the correct settings.

Is this more or less what I need to get or are there elements I'm missing?

# ? Aug 1, 2012 04:35

Partycat: Oct 25, 2004

As far as I know with the appropriate software, CME, the phones can talk to each other once it is configured, as it will do everything it needs to do internally.

If your phones are SCCP anyways.

# ? Aug 1, 2012 17:10