The Cisco Short Questions Thread v12.4.9(WTF)

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cisco Short Questions Thread v12.4.9(WTF)

«‹›431 »

CrazyLittle: Sep 11, 2001; Clapping Larry

AUX is a serial port for connecting a modem or another console device.

# ? Nov 14, 2012 04:25

Adbot: ADBOT LOVES YOU

# ? May 14, 2024 06:28

Social Media: Jan 21, 2010

double poast lol

Social Media fucked around with this message at 04:36 on Nov 14, 2012

# ? Nov 14, 2012 04:34

Social Media: Jan 21, 2010

Ah. I thought for some reason that it could work. I guess I'll need an AUI to RJ-45 transceiver to connect a switch with Ethernet cable then.

# ? Nov 14, 2012 04:36

ate shit on live tv: Feb 15, 2004; by Azathoth

ragzilla posted:

The cooling bits a typo right? You can't just magic away heat. This rack will heat up the room it's in unless you have some way to duct the heat away (or some kind of elaborate portable split system).

Is this just for rolling around inside a facility, or for travel?

I don't care about heating up the room, I just don't want the equipment to overheat, since I plan on put around 16 devices, some PoE, in an enclosed space.

# ? Nov 14, 2012 07:34

jwh: Jun 12, 2002

Buy an air conditioner for the room.

# ? Nov 14, 2012 17:54

squidflakes: Aug 27, 2009; SHORTBUS

I've taken over a bit of a mess from a previous network admin and was asked to allow traffic from our secondary data center to one of our remote offices.

Getting on the remote ASA I notice that there are only two access lists, both are basically permit ip <home network> <remote network> and there are no access-group entries.

This whole set-up is working, but I was under the impression that without something as simple as 'access-group <acl> in interface outside', you wouldn't be able to get any traffic past the ASA.

As it stands, I can access the remote office from the home office, but I can't get to it from the secondary data center. When I try to ping I get a few destination host unreachable responses from the dynamic IP of the ASA.

This is probably going to TAC tomorrow, but I was hoping this was something short and dumb on my part.

# ? Nov 15, 2012 01:00

Nitr0: Aug 17, 2005; IT'S FREE REAL ESTATE

post your sanitized config, it's probably nat.

# ? Nov 15, 2012 01:16

ragzilla: Sep 9, 2005; don't ask me, i only work here

Powercrazy posted:

I don't care about heating up the room, I just don't want the equipment to overheat, since I plan on put around 16 devices, some PoE, in an enclosed space.

Any decent 4 post mobile cabinet should work, not like it's terribly dissimilar to a datacenter deployment. Biggest consideration should be the casters as you want to make sure you get the right ones for your floor type(s).

# ? Nov 15, 2012 02:17

ragzilla: Sep 9, 2005; don't ask me, i only work here

sootikin posted:

I'm trying to make a connection from a Cisco switch's FastEthernet interface to a 2501 router's AUX port. The terminals are RJ-45 on both sides, but what type of cable do I need? The switch is a Catalyst 2924 XL if that makes any difference.

You need an Ethernet to AUI transceiver. It'll plug into the DB15 on your 2501 and give you a 10BaseT Ethernet port.

As others have mentioned the Aux port is a serial port, typically used for attaching a modem to do OOB management.

# ? Nov 15, 2012 04:32

other people: Jun 27, 2004; Associate Christ

If I want to get a used cisco switch for the house can some one suggest some models to look for? I don't know my cisco models.

I imagine anything more than 1-2 Gig ports is going to cost me a lot of $$$? I'd like to spend less than $100. Ebay is full of them, but I am having trouble assessing them.

# ? Nov 15, 2012 15:15

bort: Mar 13, 2003

Kaluza-Klein posted:

If I want to get a used cisco switch for the house can some one suggest some models to look for? I don't know my cisco models.

I imagine anything more than 1-2 Gig ports is going to cost me a lot of $$$? I'd like to spend less than $100. Ebay is full of them, but I am having trouble assessing them.

You probably want a 2950 for that price. Definitely avoid the 3548 models and there are models that run CatOS instead of IOS, e.g. 2948G. That's 10/100 money. Don't know what you're using it for, though -- if it's educational, gig doesn't matter that much. If you don't need the port count, get a consumer gigabit switch and put good firmware on it.

bort fucked around with this message at 16:15 on Nov 15, 2012

# ? Nov 15, 2012 16:07

ate shit on live tv: Feb 15, 2004; by Azathoth

Kaluza-Klein posted:

If I want to get a used cisco switch for the house can some one suggest some models to look for? I don't know my cisco models.

I imagine anything more than 1-2 Gig ports is going to cost me a lot of $$$? I'd like to spend less than $100. Ebay is full of them, but I am having trouble assessing them.

If you want Gig then it will be more than $100. Otherwise yea, 2950 is the lowest you want to go. 2912 is cheaper, but runs an extremely limited IOS so it's not even good for learning on.

3550's are going for cheap to, but again, non-gigabit, however they are layer 3 switches so you can do some routing etc.

# ? Nov 15, 2012 16:11

other people: Jun 27, 2004; Associate Christ

We have 2950s in class, I believe.

I have found 2950s for $15, and someone has 2950SXs for $30. I suppose ideally I would get a 2950T, as it would have two gigabit ports?

# ? Nov 15, 2012 16:17

ate shit on live tv: Feb 15, 2004; by Azathoth

I don't rememeber the nomenclature for the older switches, but that sounds right.

# ? Nov 15, 2012 16:19

bort: Mar 13, 2003

Again, depends what you're using it for. The 2950T is end of sale and if I were using it for IOS training, I'd get a model that's still supported. If I were actually wiring my house with a $100 switch for some reason, and I needed 24 ports in one place also for some reason, I'd buy the one with the gig ports.

e: powercrazy has a point about the 3550, too. It might be a better training device, since learning layer three is really important

bort fucked around with this message at 16:33 on Nov 15, 2012

# ? Nov 15, 2012 16:24

falz: Jan 29, 2005; 01100110 01100001 01101100 01111010

Probably just get a WS-C2950G-24-EI + Qty 2 WS-G5483, should be under $100 on ebay. Or if gig, WS-C2970G-24T-E (WS-C2970G-24TS-E is 1.5u w/ SFP ports). Both are very very EOL. Any non-EOL cisco (not rebranded linksys) switch is going to be at least $500.

# ? Nov 15, 2012 16:40

other people: Jun 27, 2004; Associate Christ

I am not using it for training per se, just to wire up the house. Using a consumer switch just wouldn't be the same post Cisco academy :allears:

. I got a 2950T for under $40 shipped. Thank you for the help.

# ? Nov 15, 2012 16:59

Mierdaan: Sep 14, 2004; Pillbug

ASA 8.2 NAT question.

Currently we just NAT all outbound traffic to one IP:

code:

access-list inside_outbound_nat0_acl extended permit ip any 10.10.0.0 255.255.0.0
nat-control
global (outside) 10 123.123.123.123 netmask 255.255.255.255
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 10 0.0.0.0 0.0.0.0

I'd like to get outbound smtp traffic NAT'd to its own address so we can set up DNS/rDNS entries specific to our MTA and have it be separate from our normal outbound traffic. This is what I've come up with, but I don't have any way to test right now:

code:

access-list inside_outbound_nat0_acl extended permit ip any 10.10.0.0 255.255.0.0
access-list inside_outbound_smtp extended permit ip any 10.10.1.8 255.255.255.255 eq smtp
nat-control
global (outside) 10 123.123.123.123 netmask 255.255.255.255
global (outside) 25 123.123.123.124 netmask 255.255.255.255
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 10 0.0.0.0 0.0.0.0
nat (inside) 25 access-list intside_outbound_smtp

Any tips appreciated.

# ? Nov 15, 2012 20:41

GOOCHY: Sep 17, 2003; In an interstellar burst I'm back to save the universe!

static (inside, outside) <public host> <private host> netmask 255.255.255.255
!
access-list outside_access_in extended permit tcp any host <public host> eq smtp log notifications
!
access-group outside_access_in in interface outside

1:1 NAT map - allow traffic inbound via SMTP

GOOCHY fucked around with this message at 21:01 on Nov 15, 2012

# ? Nov 15, 2012 20:59

CheeseSpawn: Sep 15, 2004; Doctor Rope

GOOCHY posted:

static (inside, outside) <public host> <private host> netmask 255.255.255.255
!
access-list outside_access_in extended permit tcp any host <public host> eq smtp log notifications
!
access-group outside_access_in in interface outside

1:1 NAT map - allow traffic inbound via SMTP

That's what I would do for inbound requests. The DNS option sounds like it might be required as well depending on how their DNS servers are setup.

static (inside, outside) <public host> <private host> netmask 255.255.255.255 dns

code:

access-list inside_outbound_nat0_acl extended permit ip any 10.10.0.0 255.255.0.0
nat-control
global (outside) 10 123.123.123.123 
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 10 0.0.0.0 0.0.0.0

It looks like the access list for outbound traffic is reversed? Any reason for the nat 0 bypass?

# ? Nov 15, 2012 21:35

Mierdaan: Sep 14, 2004; Pillbug

Yeah, what GOOCHY wrote is exactly what we're doing for all our public-facing services. This is the first time I've wanted to modify our setup for outbound traffic, though.

CheeseSpawn posted:

It looks like the access list for outbound traffic is reversed? Any reason for the nat 0 bypass?

There's actually 4 entries in that ACL. :

code:

access-list inside_outbound_nat0_acl extended permit ip (internal IP range) (VPN pool range)
access-list inside_outbound_nat0_acl extended permit ip any (VPN pool range)
access-list inside_outbound_nat0_acl extended permit ip any (internal IP range)
access-list inside_outbound_nat0_acl extended permit ip (internal IP range) (overseas location's range, site-to-site VPN)

Is the NAT 0 bypass there so that there's no translation performed between these internal ranges?

I agree that the ACL looks reversed - not sure why that is.

# ? Nov 15, 2012 22:08

ragzilla: Sep 9, 2005; don't ask me, i only work here

Mierdaan posted:

Is the NAT 0 bypass there so that there's no translation performed between these internal ranges?

Yes, nat 0 is 'NAT exempt'.

# ? Nov 15, 2012 23:18

CheeseSpawn: Sep 15, 2004; Doctor Rope

Mierdaan posted:

Yeah, what GOOCHY wrote is exactly what we're doing for all our public-facing services. This is the first time I've wanted to modify our setup for outbound traffic, though.

There's actually 4 entries in that ACL. :
code:
access-list inside_outbound_nat0_acl extended permit ip (internal IP range) (VPN pool range)
access-list inside_outbound_nat0_acl extended permit ip any (VPN pool range)
access-list inside_outbound_nat0_acl extended permit ip any (internal IP range)
access-list inside_outbound_nat0_acl extended permit ip (internal IP range) (overseas location's range, site-to-site VPN)
Is the NAT 0 bypass there so that there's no translation performed between these internal ranges?

Yeah, Nat 0 would bypass the the NAT translation. It's looks like there's a lot more you have going on on your ASA that we can see. I'm guessing the nat0_ACL is being applied on some other interface. To me, it doesnt seem like that is the ACL you need to place your outbound ACL rule at because they dont make sense to me in an outbound direction. I should see something similar to below where there is a something going to any as a destination unless your traffic is going to here <ip any (internal IP range)> and then going out to the internet there which is weird and redundant.

access-list outbound_ACL extended permit ip 10.10.0.0 255.255.0.0 any

NAT STATEMENTS

access-group outbound_ACL in interface inside

# ? Nov 16, 2012 00:42

BurgerQuest: Mar 17, 2009; by Jeffrey of YOSPOS

falz posted:

Probably just get a WS-C2950G-24-EI + Qty 2 WS-G5483, should be under $100 on ebay. Or if gig, WS-C2970G-24T-E (WS-C2970G-24TS-E is 1.5u w/ SFP ports). Both are very very EOL. Any non-EOL cisco (not rebranded linksys) switch is going to be at least $500.

Most brokers will sell you refurb Cisco 2960 24pt+2xgbit (WS-C2960-24TT-L)for ~$200 refurb (cheaper by volume). Atleast in Australia anyway. We order like 10 a month. You can even get smartnet contracts for them should you so desire. I won't plug a particular broker but PM me if you want to know where we shop. I'd be surprised if ebay cost more for these than a broker.

# ? Nov 16, 2012 09:07

Gap In The Tooth: Aug 16, 2004

BurgerQuest posted:

Cisco 2960

I was surprised no-one mentioned the 2960 earlier, they have 2x gig ports and can support "limited" routing/layer 3 capability starting from IOS version 12.2(55)SE3.

vvvv true

Gap In The Tooth fucked around with this message at 04:46 on Nov 19, 2012

# ? Nov 18, 2012 19:53

falz: Jan 29, 2005; 01100110 01100001 01101100 01111010

Because he wanted to spend under $100.

# ? Nov 19, 2012 00:28

jwh: Jun 12, 2002

I'm glad they got rid of nat 0, finally.

# ? Nov 19, 2012 20:36

Mierdaan: Sep 14, 2004; Pillbug

For anyone following me trying to figure out how ASA NAT works, it was simple in the end. Mostly I was confused trying to figure out what the point is of ACLs that don't actually permit/deny traffic, just exist for the purposes of matching traffic to a NAT ID.

The inside_outbound_nat0_acl access list was just for matching traffic for the NAT bypass. We just added two new ACL entries to our outside_access_in for the host we cared about, and static (inside,outside) <internal IP> <external IP>, bam, done.

# ? Nov 19, 2012 20:58

ate shit on live tv: Feb 15, 2004; by Azathoth

The first ACL defines interesting traffic, i.e. traffic that will be trans-versing the NAT boundary. Like you said, MATCHING traffic. After that you need to define where that traffic is NATted to. That same matching ACL defines any traffic that will be Cryptod through a tunnel or w/e.

Don't get too used to it though because ASAs change the way their NAT works every major release, and sometimes the interim releases too

# ? Nov 19, 2012 21:40

jwh: Jun 12, 2002

The NAT 0 way was a vestigial practice, due to the nature of the box. If you build a box that mostly just does NAT, it stands to reason you'd need an explicit way to tell it NOT to do NAT.

Unfortunately, it's a backwards way of doing things.

The ASA changes post 8.2 and 8.4 went a long way toward making the ASA a more 'modern' piece of equipment, thankfully.

Although I'm surprised that Cisco hasn't brought the CX module down to the rest of the X line. I imagine Cisco is getting murdered out there by Palo Alto and others in the small enterprise segment.

# ? Nov 19, 2012 21:59

ate shit on live tv: Feb 15, 2004; by Azathoth

I wonder when cisco wil give up on the firewall segment, at least commercially/SOHO.

# ? Nov 19, 2012 23:01

Gweenz: Jan 27, 2011

I have a customer who needs a port opened in their RVS4000 and the guy who configured it did not write down the admin password, and he no longer works here. I have done the password recovery process on an 1800 router before. Is there a similar process with the RVS4000? I would prefer not to do a hard reset and lose the configuration.

Thanks!

Gweenz fucked around with this message at 04:22 on Nov 20, 2012

# ? Nov 19, 2012 23:41

rattrap: Mar 25, 2005

Gweenz posted:

I have done the password recovery process on an 1800 router before. Is there a similar process with the RVS4000? I would prefer not to do a hard reset and lose the configuration.

I would say that there is almost assuredly not a password recovery option besides factory defaulting. That looks like a consumer line device (aka Linksys). OS and development are completely separate between the consumer and enterprise/SP hardware.

# ? Nov 20, 2012 07:47

psydude: Apr 1, 2008

Mierdaan posted:

For anyone following me trying to figure out how ASA NAT works, it was simple in the end. Mostly I was confused trying to figure out what the point is of ACLs that don't actually permit/deny traffic, just exist for the purposes of matching traffic to a NAT ID.

The inside_outbound_nat0_acl access list was just for matching traffic for the NAT bypass. We just added two new ACL entries to our outside_access_in for the host we cared about, and static (inside,outside) <internal IP> <external IP>, bam, done.

When you get right down to it, a NAT is just dynamic policy based routing that uses control lists to source its mapping.

# ? Nov 21, 2012 01:09

H.R. Paperstacks: May 1, 2006; This is America
My president is black
and my Lambo is blue

So who experienced all the fun NTP issues yesterday/today?

Good work USNO.

They apparently rebooting Tick/Tock servers and when they did, they came back up in the year 2000 and caused all kinds of issues.

# ? Nov 21, 2012 02:21

Ninja Rope: Oct 22, 2005; Wee.

I don't really manage a lot of network gear, but all my servers refuse automatic time changes that are more than a few minutes off, and even then the clock is slewed instead of stepped. What devices step the clock regardless of the offset?

# ? Nov 21, 2012 02:33

H.R. Paperstacks: May 1, 2006; This is America
My president is black
and my Lambo is blue

Ninja Rope posted:

I don't really manage a lot of network gear, but all my servers refuse automatic time changes that are more than a few minutes off, and even then the clock is slewed instead of stepped. What devices step the clock regardless of the offset?

That is how it is supposed to work, no Stratum 2 should have ever accepted the update with that far of a drift, but apparently most did.

# ? Nov 21, 2012 02:33

madsushi: Apr 19, 2009; Baller.
#essereFerrari

routenull0 posted:

So who experienced all the fun NTP issues yesterday/today?

Good work USNO.

They apparently rebooting Tick/Tock servers and when they did, they came back up in the year 2000 and caused all kinds of issues.

A partner of ours experienced the same thing. That's why I always use sundial.columbia.edu

# ? Nov 21, 2012 02:37

ate shit on live tv: Feb 15, 2004; by Azathoth

routenull0 posted:

That is how it is supposed to work, no Stratum 2 should have ever accepted the update with that far of a drift, but apparently most did.

That's really bizarre. Why would any NTP time source ever accept that type of update unless it were manual.

Even our terribly managed windows domain rejected the incorrect Stratum 2 servers.

# ? Nov 21, 2012 02:51

Adbot: ADBOT LOVES YOU

# ? May 14, 2024 06:28

ragzilla: Sep 9, 2005; don't ask me, i only work here

routenull0 posted:

So who experienced all the fun NTP issues yesterday/today?

Good work USNO.

They apparently rebooting Tick/Tock servers and when they did, they came back up in the year 2000 and caused all kinds of issues.

GPS time server on site crew represent.

# ? Nov 21, 2012 02:55

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cisco Short Questions Thread v12.4.9(WTF)

«‹›431 »