The Cisco Short Questions Thread v12.4.9(WTF)

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cisco Short Questions Thread v12.4.9(WTF)

«‹›11 »

Tremblay: Oct 8, 2002; More dog whistles than a Petco

sudo rm -rf posted:

Hey friends, nat question.

I am currently not NAT'ing for a DMZ that I admin. We've got a /24 of public IP space. Our upstream firewall blocks basically everything that isn't on a list of a few standard ports. I have a synology NAS that seems to only want to host its management web page on port 5000. There doesn't seem to be a good way to change this on the device itself, and most of the recommendations seem to point to port forwarding, which makes since for a consumer NAS. My NAT'ing is a little rusty, so my question is this.

Can I static NAT for a single IP address, solely for doing a 80 -> 5000 translation, without affecting non-NAT traffic for any other device? Or will all other traffic attempt to NAT itself once I add a nat rule?

This is on an ASA 5520.

Yes, this is definitely do able.

# ¿ Jan 28, 2015 22:10

Adbot: ADBOT LOVES YOU

# ¿ May 15, 2024 16:10

Tremblay: Oct 8, 2002; More dog whistles than a Petco

Partycat posted:

TAC has had a bunch of excellent engineers available in the last few months, and less Convergys doorknobs. If you get a good one, though, clear your schedule cause they get distracted and dematerialize for weeks at a time if you don't take their calls.

The number of cases that come in are staggering, and the range from mundane, to holy poo poo wtf is happening is pretty wide too. I think I one point I was working 100 cases simultaneously. There was another guy on my team that was up around 140.

# ¿ Feb 16, 2015 20:53

Tremblay: Oct 8, 2002; More dog whistles than a Petco

adorai posted:

I have had one of those "wtf is happening" cases open since JULY of 2014. I have had a few engineers on it, and I can tell they just don't want to take the time to figure it out. It's quite irritating.

Can you PM me the case number? Be interested to take a look.

I don't work in TAC anymore. I'm also not making excuses for less than stellar service at times.

# ¿ Feb 17, 2015 00:30

Tremblay: Oct 8, 2002; More dog whistles than a Petco

Bigass Moth posted:

I thought it showed all messages for the level you choose and anything below (ie, you set the log for all level 4 notification, but you also get 5,6,7 since they are "lower"). Have I misread?

The question rephrased is: why not choose level 0 to get 0-7 notifications logged? You'll get all the "less serious" things but also logs of the major system impacting issues.

I think you have your numbering backwards if you are talking about syslog. That said it's about cutting down on noise and volume. Most devices let you reclass specific messages. This greatly lets you reduce the noise.

# ¿ Feb 18, 2015 04:39

Tremblay: Oct 8, 2002; More dog whistles than a Petco

Ahdinko posted:

I don't know about any of the ones you mentioned since I've never used them, but since you're asking in the Cisco thread, what about two ASA 5512-X's for your main office, and maybe a 5505 or a single 5512-x for your other office?

Three 5512-X's + security plus licenses + 50 concurrent user vpn perpetual licenses will cost you as much as two months of your cloud firewall things, will give you up to 250 site to site vpns (licenses included) and will work in active/active and do QoS. As well as handle up to a gig of straight internet traffic, or 200mb of encrypted traffic.

5506 is shipping now and has SourceFire integrated. There will be a model with a built in AP that can run standalone or lightweight very shortly.

# ¿ Feb 24, 2015 22:56

Tremblay: Oct 8, 2002; More dog whistles than a Petco

1000101 posted:

You'd still use some /30s for the point to point links. You've only got 4 devices doing l3 in the diagram so even with a full mesh you're not looking at a whole lot of routes in the routing table. If there's more to the topology then you could create a null0 route and put that in the IGP. When packets hit your core your more specific /30 routes will take precedence.

If its only ptp use /31

# ¿ Mar 9, 2015 17:19

Tremblay: Oct 8, 2002; More dog whistles than a Petco

Moey posted:

Any point in using PFS on a site to site VPN if it isn't going over the internet?

How paranoid are you? I don't mean this in a derogatory way.

# ¿ Mar 13, 2015 01:47

Tremblay: Oct 8, 2002; More dog whistles than a Petco

madsushi posted:

RANCID question:

I am running into an issue with RANCID and some Nexus 3K's. On a regular basis, "show run" returns some config lines in a different order, which RANCID sees as a change. I have confirmed this by hitting "show run" like 20 times fast on the console, and I see it come back out-of-order.

This is an example:

The "switchport access vlan 100" line wasn't added/removed, it just ended up out-of-order with the access-group listing. This is causing us to get a ton of noise in our RANCID email alerts. I don't want to just //ignore the line, because that would make it complicated if a NOC tech needs to dump a config from RANCID onto the device (we'd have to remember to put that line [or lines] back in explicitly).

Any thoughts on a way to fix this? I looked into something like sorting but never got it to work.

Do you guys only have any of the other Nexus switches (9,7,6,5)? Curious if it's product specific or NX issue.

# ¿ Mar 19, 2015 23:12

Tremblay: Oct 8, 2002; More dog whistles than a Petco

madsushi posted:

We have 7ks and 5ks but have not seen the issue there, although we also don't have the "ip access-group" setting on any of those, if that's the one that floats.

One of my customers has several hundred 3ks. They don't use RANCID however they have other similar tools that are used to monitor and correct config drift. I've never heard anything like this, but certainly will ask around.

# ¿ Mar 19, 2015 23:57

Tremblay: Oct 8, 2002; More dog whistles than a Petco

Read this:

http://www.cisco.com/c/en/us/td/docs/security/asa/asa83/upgrading/migrating.html

You were running super old code on that 5505 I gather.

# ¿ Jul 15, 2015 18:16

Tremblay: Oct 8, 2002; More dog whistles than a Petco

It really depends on what other things CM data is used for. Peer reviews are common sense, a second set of eyes doesn't hurt when you are talking about changes that are more significant than code upgrades and reconfiguring user ports.

# ¿ Jan 22, 2016 07:26

Tremblay: Oct 8, 2002; More dog whistles than a Petco

adorai posted:

we use fortigates with bai or whatever they are called today for IDS monitoring. FortiOS is pretty intuitive, and has an excellent gui if that is your thing.

FortiOS is far from intuitive. We have hundreds of Fortigates, and after how they've handled the FM login security issue I have no trust in their products.

# ¿ Jan 23, 2016 01:12

Adbot: ADBOT LOVES YOU

# ¿ May 15, 2024 16:10

Tremblay: Oct 8, 2002; More dog whistles than a Petco

falz posted:

How is this different / worse than other vendors ? Also all firewaslls are the worst.

It's not bad once you learn each vendors quirks. From experience with PIX/ASA/FWSM/Fortigate. I have a hell of an easier time with Cisco, but thats largely due to my experience with the platform.

# ¿ Jan 27, 2016 21:30

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cisco Short Questions Thread v12.4.9(WTF)

«‹›11 »