Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
sudo rm -rf
Aug 2, 2011


$ mv fullcommunism.sh
/america
$ cd /america
$ ./fullcommunism.sh


I just received some of my hardware for my CCNA lab, and my two 2950s came without any IOS image. After much googling, it seemed like xmodem was the only way to get an image on the switches - so I set the BAUD rate to 115200 on both the switch and my com port (which is a usb-to-serial adapter), and started the transfer. Well, it's going pretty slow - only about 211 Bytes/s - it should be going faster than that, right? Any ideas why it wouldn't?

Adbot
ADBOT LOVES YOU

sudo rm -rf
Aug 2, 2011


$ mv fullcommunism.sh
/america
$ cd /america
$ ./fullcommunism.sh


less than three posted:

Are you transferring in xmodem 1k mode?

Not sure. I ended up canceling the transfer and switched term emulators (from terma to securecrt) and started the transfer again - worked fine.

Moving onto my router brought me more issues, though. I got a 2621xm from amazon (specifically, SAM networks). Hooked it all up, set the baud rate to 9600 - no console response. Changed the baud rate around to the various possible rates, still no response. Take a look at my front LEDs and sure enough:

quote:

Blink (500 ms ON, 500 ms OFF, 2 seconds between codes)—In
ROMMON, error detected.

is what I'm getting. Is my router probably shot?

sudo rm -rf
Aug 2, 2011


$ mv fullcommunism.sh
/america
$ cd /america
$ ./fullcommunism.sh



I just ended up getting a refund, fortunately.

Another question, though. Got my other router in, working fine - but I went to set-up SSH v2, and it's missing the 'version' part of the command.

code:
a0-f0-r0(config)#ip ssh ?      
  authentication-retries  Specify number of authentication retries
  break-string            break-string
  logging                 Configure logging for SSH
  port                    Starting (or only) Port number to listen on
  rsa                     Configure RSA keypair name for SSH
  source-interface        Specify interface for source address in SSH
                          connections
  time-out                Specify SSH time-out interval
Here's my ver output

code:
a0-f0-r0#sh ver
Cisco Internetwork Operating System Software 
IOS (tm) C2600 Software (C2600-IK9S-M), Version 12.3(22), RELEASE SOFTWARE (fc2)
Technical Support: [url]http://www.cisco.com/techsupport[/url]
Copyright (c) 1986-2007 by cisco Systems, Inc.
Compiled Wed 24-Jan-07 16:48 by ccai
Image text-base: 0x80008098, data-base: 0x81CBC398

ROM: System Bootstrap, Version 12.2(8r) [cmong 8r], RELEASE SOFTWARE (fc1)
ROM: C2600 Software (C2600-IK9S-M), Version 12.3(22), RELEASE SOFTWARE (fc2)

a0-f0-r0 uptime is 5 hours, 29 minutes
System returned to ROM by reload
System image file is "flash:c2600-ik9s-mz.123-22.bin"
Google isn't getting me anywhere - any ideas?

e:figured it out - apparently even though SSHv2 was first introduced in 12.2, it's not available for the version of IOS that I have.

sudo rm -rf fucked around with this message at 03:18 on Jul 23, 2013

sudo rm -rf
Aug 2, 2011


$ mv fullcommunism.sh
/america
$ cd /america
$ ./fullcommunism.sh


I don't actually work in the industry yet, only just got my CCENT/studying for the CCNA, but is there a problem with having a Cisco-only shop?

sudo rm -rf
Aug 2, 2011


$ mv fullcommunism.sh
/america
$ cd /america
$ ./fullcommunism.sh


So I've got a phone interview with a company tomorrow that works with Cisco UCS B and C series servers - and welp, I've never heard of them before today. What are they? How do they relate to the rest of Cisco's products? The extent of my technical knowledge is CCNA-level, and these devices don't even appear to be dedicated towards networking.

sudo rm -rf
Aug 2, 2011


$ mv fullcommunism.sh
/america
$ cd /america
$ ./fullcommunism.sh


So I started working at my first "real" job out of college, and I'm basically going to be taking over a few server rooms that each have four/five racks as well as a couple classrooms with some lab computers. The equipment is a mix of Cisco video products (think QAM modulators), server products (UCS, DNCS, etc), and networking products (various routers and switches). I also get a /23 to play with, but at the moment everything seems to be thrown into a single network - no logical or physical subnets at the moment.

The server rooms are kind of cluttered. No real cable management - coaxial and ethernet everywhere. No real documentation either. About 25% of the equipment is no longer being used, and there aren't any real-time monitoring systems in place.

I feel like I can do this, I just haven't done it yet, so I'm not sure where to start. I started building an inventory using an excel sheet to get an idea of where things are physically - I figure the next step is to document how everything is connected.

I want to get into a position where this equipment can be centrally managed and monitored. I figure you guys could point me in the right direction.

sudo rm -rf
Aug 2, 2011


$ mv fullcommunism.sh
/america
$ cd /america
$ ./fullcommunism.sh


What kind of switches should I be looking at for top-of-rack 10g uplinks to a core 6509-e? Something like the 3650-X?

sudo rm -rf
Aug 2, 2011


$ mv fullcommunism.sh
/america
$ cd /america
$ ./fullcommunism.sh


Badgerpoo posted:

Are you looking for 1Gb or 10Gb edge ports? Do you want to stack?

1 GB, and I don't think stacking is a priority.

sudo rm -rf
Aug 2, 2011


$ mv fullcommunism.sh
/america
$ cd /america
$ ./fullcommunism.sh


This might be a obscure, but is anyone familiar with Cisco's ROSA products? I've got an Element Manager I'm using as an SNMP trap, but the trap its getting from our 4948E is coming with the incorrect severity levels (linkdown and linkup are being received as INFORMATION instead of CRITICAL or ALARM). Is there a way to change the severity levels on the switch itself? Running 15.0.

code:

4948E#sh run | include snmp
snmp-server community public RO
snmp-server community private RO wr
snmp-server enable traps snmp authentication linkdown linkup coldstart warmstart
snmp-server host XXX.XXX.XXX.XXX public

sudo rm -rf
Aug 2, 2011


$ mv fullcommunism.sh
/america
$ cd /america
$ ./fullcommunism.sh


Any resources/books you guys can point me to for data center design/infrastructure? It's becoming increasingly likely we're going to be doing a complete rebuild of our four labs that total around 24 racks.

sudo rm -rf
Aug 2, 2011


$ mv fullcommunism.sh
/america
$ cd /america
$ ./fullcommunism.sh


I'll be a little more forth-coming - I'm part of a small, specialized team within a 'certain' large IT organization that everyone of you should be very familiar with. Certain infrastructure costs will be heavily-discounted and our purpose is pretty niche (Service Provider Video), so it's not something that can be done off-site.

I'm just a recent college graduate that was brought in to support these labs - I want/need to learn about data center design as much as possible.

sudo rm -rf
Aug 2, 2011


$ mv fullcommunism.sh
/america
$ cd /america
$ ./fullcommunism.sh


The latter stuff.

sudo rm -rf
Aug 2, 2011


$ mv fullcommunism.sh
/america
$ cd /america
$ ./fullcommunism.sh


ruro posted:

Most of DC design is super obvious if you've ever had to support or manage a DC, but if you haven't done it before you'll get caught out on things like air flow design or not running sufficient fibre (run more than you need!). If you are in a large organization do they have any other DCs you can visit? If so is there another group of internal people who can give advice? I think that would be a good place to start.

I'm sure they do. I'm just pretty new and the organization is quite large.

sudo rm -rf
Aug 2, 2011


$ mv fullcommunism.sh
/america
$ cd /america
$ ./fullcommunism.sh


Is there a golden standard for patch panels and racks that you guys shoot for? We're gonna be grabbing a couple racks and need to get a bunch of patch panels eventually.

sudo rm -rf
Aug 2, 2011


$ mv fullcommunism.sh
/america
$ cd /america
$ ./fullcommunism.sh


Ashley Madison posted:

Are you looking for a brand or a way of putting the rack together?


E:
Whatever fits your budget. Our data centre and secondary cores use APC racks, Tyco for copper and fibre.
Our distribution closets are mixed Tyco or Belden, depending upon the nature of the project at the time.
Offices with a lot of drops (24 to 48) have their own Hubbell cabinets with a fibre feed.

I guess brands. We just got in two 5548s we're going to use as a collapsed core with 2k fabric extenders in an EoR position. Right now we don't have any patch panels and literally run our copper from switch to server for each instance. As you can imagine it's a bit of a mess and I'm trying to do everything that I can to make the lab/data center as standardized and efficient as possible.

sudo rm -rf
Aug 2, 2011


$ mv fullcommunism.sh
/america
$ cd /america
$ ./fullcommunism.sh


So I'm pretty loving excited. I got to do this for the first time on a nexus device today.

code:
switch# sh ver
Cisco Nexus Operating System (NX-OS) Software
TAC support: [url]http://www.cisco.com/tac[/url]
Documents: [url]http://www.cisco.com/en/US/products/ps9372/tsd_products_support_serie[/url]
s_home.html
Copyright (c) 2002-2013, Cisco Systems, Inc. All rights reserved.
The copyrights to certain works contained herein are owned by
other third parties and are used and distributed under license.
Some parts of this software are covered under the GNU Public
License. A copy of the license is available at
[url]http://www.gnu.org/licenses/gpl.html.[/url]

Software
  BIOS:      version 3.6.0
  loader:    version N/A
  kickstart: version 5.2(1)N1(4)
  system:    version 5.2(1)N1(4)
  power-seq: Module 1: version v2.0
             Module 2: version v1.0
             Module 3: version v5.0
  uC:        version v1.2.0.1
  SFP uC:    Module 1: v1.1.0.0
  BIOS compile time:       05/09/2012
  kickstart image file is: bootflash:///n5000-uk9-kickstart.5.2.1.N1.4.bin
  kickstart compile time:  3/19/2013 3:00:00 [03/19/2013 10:12:59]
  system image file is:    bootflash:///n5000-uk9.5.2.1.N1.4.bin
  system compile time:     3/19/2013 3:00:00 [03/19/2013 12:10:47]


Hardware
  cisco Nexus5548 Chassis ("O2 32X10GE/Modular Universal Platform Supervisor")
  Intel(R) Xeon(R) CPU         with 8263848 kB of memory.
  Processor Board ID FOC17515LG7

  Device name: switch
  bootflash:    2007040 kB
A brand new 5548UP and it's all mine.

sudo rm -rf
Aug 2, 2011


$ mv fullcommunism.sh
/america
$ cd /america
$ ./fullcommunism.sh


Any advice on removing stripped rack ear screws?

sudo rm -rf
Aug 2, 2011


$ mv fullcommunism.sh
/america
$ cd /america
$ ./fullcommunism.sh


vPC is blowing my loving mind. It was so simple to enable and set up, but I have no idea how everything else works now.

I'm trying to create a trunk link between a port on my vPC'd fabric extender and the esxi host I have connected to it. Do I configure the vlan information and fex interfaces on only one of the n5ks? Both? How do SVIs work now? If we were going to do routing on the N5Ks between our vlans, do only one of the N5Ks need the necessary SVIs? Either I can't find the answers, or they're just that beyond my level of understanding that I can't even recognize them as answers.

Help, you're my only hope.

sudo rm -rf
Aug 2, 2011


$ mv fullcommunism.sh
/america
$ cd /america
$ ./fullcommunism.sh


You guys are the best, that helped a lot.

sudo rm -rf
Aug 2, 2011


$ mv fullcommunism.sh
/america
$ cd /america
$ ./fullcommunism.sh


I'm back! How do I set up NTP on a 5548UP so that devices on its various vlans can use it as the NTP server? Is this possible?

sudo rm -rf
Aug 2, 2011


$ mv fullcommunism.sh
/america
$ cd /america
$ ./fullcommunism.sh


We're on 5.2 (1), but I was able to get ntp to some devices using 'ntp distribute'. Fortunately the devices that need NTP are some cisco call managers and telepresence vcs appliances - so I'm guessing CFS works with them.

sudo rm -rf
Aug 2, 2011


$ mv fullcommunism.sh
/america
$ cd /america
$ ./fullcommunism.sh


chestnut santabag posted:

Depends on what you've got configured for NTP already.
If you've got NTP servers configured on your Nexus to update their times, then you shouldn't need any additional configurations to use your Nexus switches as NTP servers.
I'm fairly certain you don't need the 'ntp distribute' command - your devices might just not have updated immediately. NTP can take a while to settle on the correct time.

Yeah you're probably right. We didn't realize the 5k was actually working until I went back into our little video appliance and attempt to test a windows box I had started working on.

In another update from sudo's first networking job, gently caress ASAs. I'll probably be asking for help about that later this weekend, but right now my brain needs time to recover.

sudo rm -rf
Aug 2, 2011


$ mv fullcommunism.sh
/america
$ cd /america
$ ./fullcommunism.sh


One of our Nexus 5ks restarted over the weekend. Any ideas what this means?

pre:
Reset Reason for this card:
        Image Version : 5.2(1)N1(4)
        Reset Reason (LCM): Unknown (0) at time Wed Mar 26 11:30:34 2014
        Reset Reason (SW): Unknown (0) at time Sat Mar 22 06:17:30 2014
          Service (Additional Info):
        Reset Reason (HW): uC reset code: 0x0100
          ADM1066 Power Good Triggered Reset at time Sat Mar 22 06:17:30 2014

sudo rm -rf
Aug 2, 2011


$ mv fullcommunism.sh
/america
$ cd /america
$ ./fullcommunism.sh



Thanks, looks like that matches my issue pretty well.

sudo rm -rf
Aug 2, 2011


$ mv fullcommunism.sh
/america
$ cd /america
$ ./fullcommunism.sh


Is Spiceworks as useful as it looks? The training lab I admin for needs some sort of network monitoring solution, and spiceworks seems pretty interesting. We basically have nothing but cisco equipment (switches, telepresence, spv), which is why I'm asking you guys.

sudo rm -rf
Aug 2, 2011


$ mv fullcommunism.sh
/america
$ cd /america
$ ./fullcommunism.sh


What about Cisco Prime? Has anyone used it?

sudo rm -rf
Aug 2, 2011


$ mv fullcommunism.sh
/america
$ cd /america
$ ./fullcommunism.sh


What's the proper way to handle PIM rendezvous points in a vPC topology where my two N5Ks are also serving as gateways for my multicasting VLANs? Should I use BSR? What interfaces would I use for it? Here's what the SVIs look like:

code:
N5K-1

interface Vlan20
  no shutdown
  description Headend-VLAN
  vrf member ec-lab-1
  ip address 10.253.0.253/18
  ip pim sparse-mode
  hsrp version 2
  hsrp 20
    preempt
    priority 110
    ip 10.253.0.254

interface Vlan24
  no shutdown
  description BFS-Multicast-Interface
  vrf member ec-lab-1
  ip address 172.16.40.253/24
  ip pim sparse-mode
  hsrp version 2
  hsrp 24
    preempt
    priority 110
    ip 172.16.40.254
  ip dhcp relay address 10.253.0.1
  ip dhcp relay address 172.16.40.0


N5K-2

interface Vlan20
  no shutdown
  description Headend-VLAN
  vrf member ec-lab-1
  ip address 10.253.0.252/18
  ip pim sparse-mode
  hsrp version 2
  hsrp 20
    ip 10.253.0.254

interface Vlan24
  no shutdown
  description BFS-Multicast-Interface
  vrf member ec-lab-1
  ip address 172.16.40.252/24
  ip pim sparse-mode
  hsrp version 2
  hsrp 22
    ip 172.16.40.254
  ip dhcp relay address 10.253.0.1
  ip dhcp relay address 172.16.40.0

sudo rm -rf
Aug 2, 2011


$ mv fullcommunism.sh
/america
$ cd /america
$ ./fullcommunism.sh


Yeah I haven't done either, so I guess my question would be - what interface do you use? Other than my SVIs, I don't have any layer 3 interfaces for the N5Ks. Looking at a configuration guide led me to believe that you would use a loopback interface, but if the second N5K doesn't have a route to the first N5K's loopback I'm not sure how that would work.

sudo rm -rf
Aug 2, 2011


$ mv fullcommunism.sh
/america
$ cd /america
$ ./fullcommunism.sh


I don't have an IGP running. The only routing going on is between my VLANs. Would that break multicast in a vPC topology?

You can tell this is pretty new to me.

sudo rm -rf
Aug 2, 2011


$ mv fullcommunism.sh
/america
$ cd /america
$ ./fullcommunism.sh


Is there a way to limit debugging output to a specific vrf in NX-OS?

sudo rm -rf
Aug 2, 2011


$ mv fullcommunism.sh
/america
$ cd /america
$ ./fullcommunism.sh


1000101 posted:

Not really. What are you debugging specifically? Maybe you could filter it via some other means (say interface or source/destination address?)

Wanted to investigate the conversion between a dhcp server and its clients.

sudo rm -rf
Aug 2, 2011


$ mv fullcommunism.sh
/america
$ cd /america
$ ./fullcommunism.sh


Hey friends, nat question.


I am currently not NAT'ing for a DMZ that I admin. We've got a /24 of public IP space. Our upstream firewall blocks basically everything that isn't on a list of a few standard ports. I have a synology NAS that seems to only want to host its management web page on port 5000. There doesn't seem to be a good way to change this on the device itself, and most of the recommendations seem to point to port forwarding, which makes since for a consumer NAS. My NAT'ing is a little rusty, so my question is this.

Can I static NAT for a single IP address, solely for doing a 80 -> 5000 translation, without affecting non-NAT traffic for any other device? Or will all other traffic attempt to NAT itself once I add a nat rule?

This is on an ASA 5520.

sudo rm -rf
Aug 2, 2011


$ mv fullcommunism.sh
/america
$ cd /america
$ ./fullcommunism.sh


ragzilla posted:

This pains me to even suggest it- but I wonder if enabling directed broadcast on the interfaces, then setting helper addresses to both other subnet broadcast addresses would work. It looks like 137/138 are supported by default.

Funny enough, this solution was literally mentioned by Jeremy Cioara in the latest CCNP SWITCH course as a work-around where he encountered a very similar NetBIOS issue.

Speaking of CCNP SWITCH - I destroyed my home lab with a nasty broadcast loop, and I just want to make sure I understand the cause.

This my home topology:



Basically I started turning all my po interfaces off so that I could gently caress around with some STP stuff. I started with my two 2950s, which had this running config:

code:
interface FastEthernet0/1
 switchport mode trunk
 switchport nonegotiate
 channel-group 2 mode passive
!
interface FastEthernet0/2
 switchport mode trunk
 switchport nonegotiate
 channel-group 2 mode passive
This is how it looked from the 3550 side:

code:
3550b#sh etherchannel summary 
Flags:  D - down        P - bundled in port-channel
        I - stand-alone s - suspended
        H - Hot-standby (LACP only)
        R - Layer3      S - Layer2
        U - in use      f - failed to allocate aggregator

        M - not in use, minimum links not met
        u - unsuitable for bundling
        w - waiting to be aggregated
        d - default port


Number of channel-groups in use: 2
Number of aggregators:           2

Group  Port-channel  Protocol    Ports
------+-------------+-----------+-----------------------------------------------
1      Po1(SU)          -        Fa0/1(P)    Fa0/2(P)    Fa0/23(P)   
2      Po2(SU)         LACP      Fa0/3(P)    Fa0/4(I)    
I started by doing this:

code:
2950b(config)#int fa0/2
2950b(config-if)#no channel-group
Then I went over to the 3550 and did the same thing:

code:
3550b(config)#interface fastEthernet 0/4
3550b(config-if)#no channel-group 
No big deal, I continued and did the same thing for fa0/1 on the 2950 and fa0/3 on the 3550, and then repeated the steps on the other port-channel between 3550t and 2950t. Cool, no more Po2. Then I moved on to Po1 between my two 3550s, which were using the same three ports on both sides - fa0/1, fa0/2, and fa0/23.

Here's where I think I hosed up. I had added an additional trunk between 3550t and 3550b that was not on my topology, at fa0/13 on both switches. When I went to remove port fa0/23 from the port-channel on 3550b, since link aggregation was just "on" and not using LACP, my other 3550 was still pumping out packets through fa0/23 without really caring. Am I on the right track? Here's what happened from the perspective of 3550b:

code:
3550b(config)#interface fa0/23
3550b(config-if)#no channel-group 
3550b(config-if)#end
*Mar  5 23:41:28.198: %SYS-5-CONFIG_I: Configured from console by BLAHBLAH on vty0 (192.168.1.9)
3550b#sh etherchannel summary 
Flags:  D - down        P - bundled in port-channel
        I - stand-alone s - suspended
        H - Hot-standby (LACP only)
        R - Layer3      S - Layer2
        U - in use      f - failed to allocate aggregator

        M - not in use, minimum links not met
        u - unsuitable for bundling
        w - waiting to be aggregated
        d - default port


Number of channel-groups in use: 2
Number of aggregators:           2

Group  Port-channel  Protocol    Ports
------+-------------+-----------+-----------------------------------------------
1      Po1(SU)          -        Fa0/1(P)    Fa0/2(P)    
2      Po2(SD)          -        

3550b#
*Mar  5 23:42:14.642: %SW_MATM-4-MACFLAP_NOTIF: Host 000f.8f9d.87e1 in vlan 1 is flapping between port Fa0/13 and port Po1
3550b#
*Mar  5 23:42:23.598: %SW_MATM-4-MACFLAP_NOTIF: Host a820.663c.e03c in vlan 1 is flapping between port Po1 and port Fa0/13
3550b#
*Mar  5 23:42:30.026: %SW_MATM-4-MACFLAP_NOTIF: Host a820.663c.e03c in vlan 1 is flapping between port Fa0/3 and port Fa0/13
3550b#
*Mar  5 23:42:45.990: %SW_MATM-4-MACFLAP_NOTIF: Host a820.663c.e03c in vlan 1 is flapping between port Fa0/3 and port Fa0/13
3550b#
*Mar  5 23:43:00.290: %SW_MATM-4-MACFLAP_NOTIF: Host a820.663c.e03c in vlan 1 is flapping between port Fa0/3 and port Fa0/13
3550b#
*Mar  5 23:43:13.550: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/13, changed state to down
3550b#
*Mar  5 23:43:14.574: %LINK-3-UPDOWN: Interface FastEthernet0/13, changed state to down
3550b#
*Mar  5 23:43:25.110: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/23, changed state to down
3550b#
*Mar  5 23:43:28.614: %LINK-3-UPDOWN: Interface FastEthernet0/23, changed state to down
You can seem me realizing I probably had hosed something up, so I pulled the cables from fa0/13 and fa0/23. Was it the channel-group mode setting that did it?

sudo rm -rf
Aug 2, 2011


$ mv fullcommunism.sh
/america
$ cd /america
$ ./fullcommunism.sh


CCNP studying, had a question.

What would the best practice IP scheme look like for the layer 3 part of this design?



I was putting down a bunch of /30s but I wasn't really sure where I should be starting or ending when thinking about scalability or summarization.

e: If there's a book or resource that goes into this kind of thing, I'd jump all over it as well.

sudo rm -rf
Aug 2, 2011


$ mv fullcommunism.sh
/america
$ cd /america
$ ./fullcommunism.sh


What's the best way to do an IGP like ospf between two eBGP neighbors without mucking with either organization's internal routing table (assuming they were using ospf internally)?

sudo rm -rf
Aug 2, 2011


$ mv fullcommunism.sh
/america
$ cd /america
$ ./fullcommunism.sh


tortilla_chip posted:

1. Use BGP
2. Build the IGP in a separate VRF
3. Use BGP

Can you expound a bit? I'm not sure if you're suggesting that using an IGP underneath eBGP neighbors isn't recommended but that if I had to do it I'd use a VRF, or if it's fine/common and that this is the proper way to do it.

sudo rm -rf
Aug 2, 2011


$ mv fullcommunism.sh
/america
$ cd /america
$ ./fullcommunism.sh


The use-case in my head is where you have a multi-homed edge router to an ISP, and you're using loopback addresses to establish the eBGP neighbor relationships.

sudo rm -rf
Aug 2, 2011


$ mv fullcommunism.sh
/america
$ cd /america
$ ./fullcommunism.sh


tortilla_chip posted:

Yes as you've guessed my point was to not run an IGP with an organization outside of your control. As was mentioned above, if you want to do multiple links you can use static routes with eBGP multi hop. You can also run multiple parallel sessions. Each approach has its own merits.


unknown posted:

Almost always that's handled via static routes on each end.

Or in the case of Cogent a bunch of years ago, you got two eBGP peers. 1st beer gave you the route to #2 which gave you all the routes.

Word, thanks guys.

sudo rm -rf
Aug 2, 2011


$ mv fullcommunism.sh
/america
$ cd /america
$ ./fullcommunism.sh


sup friends

i'm trying to create a ZBF config on a router inside our corporate network, and i'm not super experienced with zbf.

is there a preferred way to differentiate traffic from sources inside a given zone? like if i want to treat traffic coming from the outside internet to my dmz slightly differently than traffic from the rest of the corporate network. right now i just have an acl for an object-group that lists some internal networks. how would i implement something similar in a ZBF?

Adbot
ADBOT LOVES YOU

sudo rm -rf
Aug 2, 2011


$ mv fullcommunism.sh
/america
$ cd /america
$ ./fullcommunism.sh


so i'm going to have this, basically:

one interface - outside (faces larger corporate network and also internet)
one interface - workstation subnet (i want this mostly open to my corporate network but mostly locked down to the internet)
one interface - lab (i want this mostly locked down, only open to the workstation subnet and only outbound connections to the outside interface)

i think i have the basics of this down, my main question is on how i differentiate traffic in the outside zone from "mostly ok corporate traffic" to "mostly not ok internet traffic".

fortunately i don't have the added complication of dealing with nat, this is all publicly routable.

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply