Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
ior
Nov 21, 2003

What's a fuckass?

langer34 posted:

Does anyone have any experience configuring multiple SSID's using different security protocols on a Cisco 1130 Aironet Access Point?

Yes. (This is handwritten and might have some errors!)
code:

dot11 mbssid
dot11 ssid guestzone
 vlan 10
 authentication open
 mbssid guest-mode

dot11 ssid internal
 vlan 20
 authentication open
 authentication key-management wpa
 wpa-psk ascii foobar
 mbssid guest-mode

int fa0.10
encap dot1q 10
bridge-group 10

int fa0.20
encap dot1q 20
bridge-group 20

int dot11radio0.10
encap dot1q 10
bridge-group 10

int dot11radio0.20
encap dot1q 20
bridge-group 20

int dot11radio0
 encryption vlan 20 mode ciphers tkip aes-ccm
 ssid internal
 ssid guestzone

Adbot
ADBOT LOVES YOU

ior
Nov 21, 2003

What's a fuckass?

Funnylink posted:

I am having trouble with interference with my wireless security camera creating interference on the wireless channel.
You can tell your router to scan all channels and give you some information on which channels are the busiest. My IOS seems to be bugged though, it is not supposed to be showing 100% on all channels :)
code:
osl#term mon
osl#dot11 dot11Radio 0 carrier busy 
Frequency  Carrier Busy % 
---------  -------------- 
   2412        100 
   2417        100 
   2422        100 
   2427        100 
   2432        100 
   2437        100 
   2442        100 
   2447        100 
   2452        100 
   2457        100 
   2462        100 
   2467        100 
   2472        100

ior
Nov 21, 2003

What's a fuckass?

Ray_ posted:

So switching to Aironet 1131AG for the WAP and a 4400 series for the WLC sounds about right?

Just keep in mind that the WLC 4400 needs a gigabit port.

ior fucked around with this message at 08:14 on May 4, 2007

ior
Nov 21, 2003

What's a fuckass?

inignot posted:

There's a hardware dependency on support for AES/CCMP. When I messed around with that a year ago it was only supported in the access points. The integrated wireless in the 800/1800 and the wireless WIC didn't support it. Cisco dances around mentioning this in their documentation. If you look on the 1800 data sheet page; WPA2 is mentioned several times, but AES/CCMP isn't listed in the Wireless LAN Security Features table.
It is supported, its just cisco that are been assholes when it comes to turning it on / off in different software releases. Im running 12.4.11XJ3 right now with AES support. However if I upgrade to latest greatest (12.4.11T2) I´ll just have TKIP. (also the oldschool ssid setup).

ior
Nov 21, 2003

What's a fuckass?
One think has always annoyed me with access-lists on cisco gear, namely editing them.
I´m aware that I can add / remove lines from it, but what about remarks, they are not numbered, so I guess it cant be done without cut ´n pasting the whole thing. Any suggestions?

ior
Nov 21, 2003

What's a fuckass?

XakEp posted:

Learning Mac addys is core to STP.
Not really.

XakEp posted:

With STP off, what does the switch do in absence of this?
STP does not affect the way a switch learns mac-addresses.

ior
Nov 21, 2003

What's a fuckass?

conntrack posted:

For future reference, i did some simple testing on an 2621 and found that it maxes out
at about 50mbit. Three NATed streams results in 100% cpu usage.

So unless you are a swede a 2621 should work nicely for home use.

Keep in mind that packet sizes and number of flows matters. My 871 is rated for the same amount of PPS that a 2621. When maxing out my connection (10Mbit) with torrent traffic it hovers at about 50% cpu. In theory mine would therefore max out at about 20Mbits simplex with my traffic patterns.

But yes, a 2621 is a great home / learning router.

ior
Nov 21, 2003

What's a fuckass?

jwh posted:

I've just been put on a wireless project, and I'd be interested in hearing from people that are using any combination of 2106 controllers, lightweight AP's, or WCS.
I have quite some experience with all of these, and well, be careful about software upgrades on the WLC's, read the release notes. Other than that I'm not sure what to tell you, it works just fine when you have hammered out all the kinks. If you have any specific questions don't hesitate to ask.

Oh, stay away from anchoring and guest-tunneling on the 2106 if you plan on deploying it from the WCS until the next release.

ior
Nov 21, 2003

What's a fuckass?

jwh posted:

How is WCS at administering multiple client / sites from one installation?

We have an interesting environment where we act as a managed services provider for a number of client organizations. Our current plan is to deploy a number of 2106 controllers and lightweight radios (estimates in the ~120 controllers, ~300 radios range), and administer the entire shootin' match from WCS.

However, WCS is one of those things that isn't easy to get your mittens on unless you already have it, so we have a number of outstanding questions about it's operation. Most of those questions we hope to answer with a WCS evaluation and some pilot gear, which I hope will arrive sometime in the next few weeks.

This is what WCS does good, however with just 300 radios why not go with a WISM and H-REAP? Administrating 120 controllers vs 1 is just going to cause you lots and lots of pain.

CrazyLittle posted:

How often do any of you guys configure loopback interfaces on your routers, and what do you tend to use them for?

Always as source interfaces for routing protocols, as loopback interfaces never go down with interfaces.

ior
Nov 21, 2003

What's a fuckass?

ionn posted:

What I have at the moment are a pair of 2801's, not sure how much they can take though I can definitely try with encryption as well.

Wouldn't that router still have to fragment stuff, unless I were to lower the MTU of all hosts as well (or at least the couple of routers from which data can come, letting them fragment instead)?
What does "ip tcp adjust-mss 1400" do that "mtu 1400" doesn't?

mtu 1400 changes the mtu on the interface.

ip tcp adjust-mss 1400 alters TCP SYN packets flowing through the router so that the mss option is always lower then your specified value.

Edit: goddamnit, seems im hitting a caching proxy at my ISP, no replies to what I answer until I´ve written my answer, then BAM, a whole new page of replies.

ior
Nov 21, 2003

What's a fuckass?
Does anyone have a working anyconnect sslvpn configuration for IOS? (damnit I want search back!)

ior
Nov 21, 2003

What's a fuckass?

atticus posted:

shutting down DFC's isn't something you really want to do.

Running without DFC´s works just fine, 90% of my customers are running CFC mode with no ill effects, just keep in mind that you loose out on local switching and is therefore limited by the 40Gbps/slot backplane.

ior
Nov 21, 2003

What's a fuckass?

BoNNo530 posted:

Longshot:

Is there a way I can find out what kind of GBIC (make, model, ANYTHING) that is plugged into a slot? Show interface gives me 'GigaStack module(0.2) in GBIC slot.' but obviously this is not enough info.

I have to replace a switch that is far away in another site and I have to put 4 GBICs in the new switch for a fiber hand-off as well as a trunk to a switch on another floor.

That should be enough, gigastack is a special module with 2 connectors made for building ring-structures.

Partno: WS-X3500-XL
http://www.cisco.com/warp/public/cc/pd/si/casi/ca3550/prodlit/gbic_ds/gbic_ds3.gif

ior fucked around with this message at 15:30 on Jul 8, 2008

ior
Nov 21, 2003

What's a fuckass?

BoNNo530 posted:

Thanks guys for the quick replies..

I can't get that to work, unfortunately. This IOS is so old and I keep forgetting to flash it during off-hours.

It is a 3548 switch that will be replaced with a 2960G switch. I have 4 open GBIC slots and one slot needs to handle the GigaStack and one to handle "SX"


Here is the switch in question:

code:
******#show interfaces g0/1
GigabitEthernet0/1 is up, line protocol is up
  Hardware is Gigabit Ethernet, address is ********* (bia **************)
  Description: EMBARQ FIBER
  MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive not set
  Full-duplex, 1000Mb/s, media type is SX
  output flow-control is off, input flow-control is off
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input 00:00:01, output 00:00:22, output hang never
  Last clearing of "show interface" counters never
  Queueing strategy: fifo
  Output queue 0/40, 0 drops; 

/\OMITTED/\


**********#show interfaces g0/2
GigabitEthernet0/2 is up, line protocol is up
  Hardware is Gigabit Ethernet, address is ********* (bia **********)
  Description: To IDF 41
  MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive not set
  Full-duplex, 1000Mb/s, media type is SX
  output flow-control is off, input flow-control is off
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input 00:00:00, output 00:00:00, output hang never
  Last clearing of "show interface" counters never
  Queueing strategy: fifo
  Output queue 0/40, 0 drops; 

/\OMITTED/\


Unfortunately for you there is no gigastack for the 2960 (which has SFP ports, not GBIC).
The correct SX partno for your 2960 would be GLC-SX-MM.

ior
Nov 21, 2003

What's a fuckass?

M@ posted:

Does anyone here fancy themselves an Aironet expert? We have a customer that's having a problem with a couple access points (AIR-AP1030-A-K9) that we sold them a while back.


Here's some of the message log:


Is there really no way to fix the "will not connect to controller" issue without connecting it to a controller?

Try config auth-list add mic 00:0b:85:5f:15:e0 and so on with the mac-addresses found in the auth failure messages.

ior
Nov 21, 2003

What's a fuckass?
code:
Router#sh inventory  | inc ^PID.*WS-.*(PFC3B|SUP32)
PID: WS-SUP32-GE-3B    , VID: V06, SN: xxxxxxxxx
PID: WS-F6K-PFC3BXL    , VID: V01, SN: xxxxxxxxx
Router#sh mls cef maximum-routes 
FIB TCAM maximum routes :
IPv4                - 1007k
Discuss! (anyone from Cisco care to comment? Is this supported by TAC? Will it blocked in future IOS releases?)

Edit: removed the serials to protect the guilty.

ior fucked around with this message at 23:53 on Aug 25, 2008

ior
Nov 21, 2003

What's a fuckass?

jbusbysack posted:

Wow, I dunno why I called that DTP, but my question remains. Why allow it to negotiate instead of forcing the port bundling?

Because when someone makes a mistake while patching and patches a users laptop into the channel it will effectively blackhole 50% of the traffic going through it. Happy times were had troubleshooting why someone could access website x but not y while someone else could access y but not x.

ior
Nov 21, 2003

What's a fuckass?

hybr1d posted:

I have a Cisco ASA in my office, and even light usage of legitimate torrents kills the internet connection about once a week. Can anyone point me in the right direction for a setting to adjust to keep this from happening?

I´d say memory leak, upgrade to 8.0(4).

ior
Nov 21, 2003

What's a fuckass?

Powercrazy posted:

How to stop ARP Spam? So I get home from work and my internet is going slow as poo poo. I assume it is my roomate bit torrenting so I log into my Cisco851w just to look at the traffic. But then I notice something odd:


Obviously that is a little excessive. Since the ARP is coming from the internet I can't actually stop it at the source, but I figure I can at least stop my router from processing all the requests. But I'm not sure how to do it. I want to receive one arp from my cable modem which we will assume is 20.20.20.20 but I want to block all others.

I'm getting ARPs from both the same subnet as well as some apparently unrelated addresses from elsewhere.

So I know the solution is Access-lists, but how would I configure it to only apply to ARPs? Also is there another way to do it?

Don´t. You wont gain any measurable performance from it and it will break your connectivity with people in the same subnet as you (which tends to be quite big with cable).

ior
Nov 21, 2003

What's a fuckass?

InferiorWang posted:

Using a WLAN 4400 series controller, what's the difference between using a GUEST-LAN WLAN and a normal WLAN? I'm under the impression that for the GUEST-LAN I'll still have to build the ACLs for the VLAN just as I would with a normal WLAN? Is it just a matter of having the web authentication presented?

Guest LAN is for making a cable based webauth.

ior
Nov 21, 2003

What's a fuckass?

gwon posted:

I started another thread and got pointed here


Any tips?

Most WAAS config is done from the central manager. So a installation basically is plug it in (either inline or with 1 leg for WCCP or layer2 redirect). And run the setup script which sets ip-addresses and tells it to contact the central manager.

Basically the box does compression and caching of data going through it. So it it detects data patterns it has seen before it can drop sending it out over the WAN and have the WAAS on the other end of the WAN spit it out to the LAN side.

It also acts as a transparent proxy for some protocols reducing problems with high RTT. (mapi, cifs, nfs, http/https)
Furthermore the new WAVE applicances also can do some virtualization and run Windows2008 on it, making it possible to have a virtualized print-server, AD, dhcp etc server on the remote site)

ior fucked around with this message at 20:20 on Feb 26, 2009

ior
Nov 21, 2003

What's a fuckass?

FatCow posted:

Just had an interesting problem. I wasn't getting ARP responses on a few devices, switch had entries for the IPs and after clearing entries they would re-populate so ARP seemed to be good from the switch to the device.

Tried failing over to the redundant sup and it didn't help. We were able to resolve the issue by kicking over the line cards with 'no power enable.' Very odd.

Also with with grey market equipment will the price of smartnet be roughly the cost of a new chassis? If so it's cost prohibitive when I can get a new switch from a competitor for < $75k.

Are you using DFCs on the linecards?

ior
Nov 21, 2003

What's a fuckass?

Syano posted:

What sort of performance can I expect from an 1130ag radio? What I mean is for instance what is the maximum number of connected clients and what sort of bandwidth can this thing chug out with multiple clients connected? I have a vendor that is trying to steer me away from running multiple VLANs on a set of these things because of the potential for it to impact business application performance. I am trying to figure out if he is just trying to sell me more stuff or if his fear holds water.

We try to limit the number if concurrent users to max 20 but there really is no limit. However they all share the available bandwidth in the (im assuming) 2.4ghz band which will give you about 22Mbit/s per non-overlapping channel. In the 5ghz band there are lots and lots of channels, but the same applies there.

ior
Nov 21, 2003

What's a fuckass?

Weissbier posted:

Is there any way to find these devices without ssh'ing into every switch to find that hostname?

Use the 'detail' parameter to sh cdp nei.

code:
labcore01#sh cdp neighbors gigabitEthernet 1/8 detail
-------------------------
Device ID: sw21-1.core.emelab.net
Entry address(es): 
  IP address: 10.203.204.121
....
....
....

ior
Nov 21, 2003

What's a fuckass?

brent78 posted:


After these last lines I get no response from the console

Make sure RTS/CTS is turned off on your serialport. This tends to make it 'read only'.

ior
Nov 21, 2003

What's a fuckass?

inignot posted:

I can't claim credit for this, as I've only been at this place a year:

code:
sw1-msfc1#sh ver
Cisco Internetwork Operating System Software 
IOS (tm) MSFC Software (C6MSFC-JSV-M), Version 12.1(8b)E10, EARLY DEPLOYMENT RELEASE SOFTWARE (fc3)
TAC Support: [url]http://www.cisco.com/tac[/url]
Copyright (c) 1986-2002 by cisco Systems, Inc.
Compiled Thu 18-Apr-02 00:46 by hqluong
Image text-base: 0x60008950, data-base: 0x6184E000

ROM: System Bootstrap, Version 12.0(3)XE, RELEASE SOFTWARE 
BOOTFLASH: MSFC Software (C6MSFC-BOOT-M), Version 12.1(8b)E10, EARLY DEPLOYMENT RELEASE SOFTWARE (fc3)

sw1-msfc1 uptime is 4 years, 31 weeks, 6 days, 17 hours, 15 minutes
System returned to ROM by power-on
System restarted at 16:59:59 EST Mon Jan 10 2005
Running default software

cisco Cat6k-MSFC (R5000) processor with 114688K/16384K bytes of memory.
Processor board ID xxxxxxxx
R5000 CPU at 200Mhz, Implementation 35, Rev 2.1, 512KB L2 Cache
Last reset from power-on
Bridging software.
X.25 software, Version 3.0.0.
SuperLAT software (copyright 1990 by Meridian Technology Corp).
TN3270 Emulation software.
14 Virtual Ethernet/IEEE 802.3  interface(s)
123K bytes of non-volatile configuration memory.
4096K bytes of packet SRAM memory.

16384K bytes of Flash internal SIMM (Sector size 256K).
Configuration register is 0x2102

sw1-msfc1#
Of course, this is a hilariously out of date switch. Sup1/MFSC1 in hybrid mode.

Actually I just upgraded a similar box, it has 9 years of uptime when i shut it down. A drat miracle all the linecards booted back up.

ior
Nov 21, 2003

What's a fuckass?

Harry Totterbottom posted:

Trying to decide between a Cataalyst 3750G-48TS and a 4948(which is cheaper than the 3750) are there any major differences? Just glancing through the CDW networking readout It says that ACL's are supported on the 3750, but on the 4948 model I'm looking at it doesn't have them listed. These will be our core switches / routers in the DC so I want to make sure that we have a pretty wide feature set available.

The 4948 is a more capable switch in every way (except for stacking ;)). Yes ACLs are supported on it.

ior
Nov 21, 2003

What's a fuckass?

Harry Totterbottom posted:

Awesome, we're a small enough shop that we aren't even looking at stacking for that location. Thanks!

On another note, if you want to save money, go for a 3560 instead, it is the same as a 3750 but without stacking.

ior
Nov 21, 2003

What's a fuckass?

Slickdrac posted:

code:
interface GigabitEthernet0/0
 description ***CONNECTION TO ALL YOUR WORLDLY DESIRES***
 ip address 4.20.6.9 255.255.255.0
 no ip proxy-arp
 ip route-cache flow
 no ip mroute-cache
 duplex full
 speed auto
 media-type rj45
 no keepalive
I've been Googling all morning, but I'm terrible at it, apparently :(

Try:

int gig0/0
keepalive 10

ior
Nov 21, 2003

What's a fuckass?

Richard Noggin posted:

Is there any way to change the command prompt in IOS? RANCID doesn't like prompts that end with # instead of >

e.g.

switch# == bad
switch> == good

I've tried prompt, but it's not valid for 12.2(53)SE.

I hope you are aware that the # means you are in privileged mode and the > means you are not. Kinda doubt you can change it.

ior
Nov 21, 2003

What's a fuckass?

Richard Noggin posted:

Yup, I'm aware. Let me rephrase the question: does anyone experienced with RANCID know how to make the parser correctly interpret the 3560's priv mode prompt of # correctly? From the RANCID FAQ:

Q. I have a Cisco Catalyst switch. clogin connects, but after receiving the
prompt, it stalls until it times out. Why?
A. This may be due to your prompt. CatOS does not include an implicit '>' in
it's prompt, like IOS does. clogin looks for '>' during login, so specify
your prompt with a trailing '>'. Also see cat5rancid(1). For example:
cat5k>
cat5k> enable
Password:
cat5k> (enable)


Not very helpful, as obviously I have IOS that's spitting out #.

Give your rancid user a privilege of 1 instead of 15 (in ios) and it will be placed in unprivileged mode at login hence giving you a > prompt.

ior
Nov 21, 2003

What's a fuckass?
Look what I just got in my LAB, 1 x OC768 (40G) and 2 x 8 10GbE. Going to be used at 'The Gathering' terminating the 30Gb/s internet connection :)

ior
Nov 21, 2003

What's a fuckass?

Xenomorph posted:

What command would I use to see what MAC is on which interface? Is there such a command to help me find where this MAC is?

code:
labcore01#sh mac-address-table address 0005.318f.2c1b
Legend: * - primary entry
        age - seconds since last seen
        n/a - not available

  vlan   mac address     type    learn     age              ports
------+----------------+--------+-----+----------+--------------------------
Active Supervisor:
*   64  0005.318f.2c1b   dynamic  Yes         10   Gi2/10
Standby Supervisor:
*   64  0005.318f.2c1b   dynamic  Yes         10   Gi2/10

ior
Nov 21, 2003

What's a fuckass?

Bardlebee posted:

Oh ok, thanks for clearing that up. Will show xlate only work when its connected to the wire?

I cannot test it until early morning tomorrow and it does not recognize (nor does it have a command when I ? it.) for show xlate... the commands I get from x? are: x25, x28, x29, xconnect, and xsm.

I'll let you know what I find.

show xlate is for pix / ASA, you want show ip nat trans

ior
Nov 21, 2003

What's a fuckass?

Pudgygiant posted:

Great guess, but no it's no shut on the config. Can't believe I didn't think of that though.

I think I'm going to just chalk it up to the Taliban and keep going to reset it every couple days.

Are you powering the AP via POE, if so, try swapping out the injector.

ior
Nov 21, 2003

What's a fuckass?

mrbucket posted:

I have an 871w running IOS 15.1, the advanced IP services bundle.

Can this thing do IPV6 over a bridge (like if you run wifi on the 871w)? Googling shows that it isnt possible, but in some versions of 15 it is possible, but then it's not again and oh god.

No luck here, i had to bring home a 1252 instead.

ior
Nov 21, 2003

What's a fuckass?

para posted:

Has anyone received any new 4500's? We've been waiting months for the ones we ordered to be delivered but they keep saying there's a back order a mile long. Is anyone seeing these actually being delivered?

I am waiting for one I ordered on the 13th of July, expected ship-date is the 8th of September. However I am happy to see that the status finally has changed to 'Building in Progress'.

ior
Nov 21, 2003

What's a fuckass?

Tsaven Nava posted:

I was putting a few ports into a VLAN on one of the 24-port Catalyst 2950 switches at work the other day, and I noticed that when I do "show vlan", it lists a total of 48 ports, even though it's a 24-port switch. Why?

Could you show us that output? Sounds strange.

Tsaven Nava posted:

In the same vein, we have a mix of 24-port and 48-port 2950s, which each have 2x gigabit ports. Are these ports for uplink/trunking only, or can I plug a server into them?

They are normal ports and can be used both for uplinking / trunking / servers.

ior
Nov 21, 2003

What's a fuckass?

CrazyLittle posted:

Catalyst 3560, 3650, 3750's are pretty kickass too, ya know... they just cost way too much brand new.

Unfortunately the 3560/3750s suck in many scenarios because of their lack of buffers :( Disregarding that specific caveat they are pretty sweet.

Edit; also they suck at policing.

<rant> It blows to upgrade a customers network, going from 3550 to 3560 and get into trouble because the new shiny box does not perform as well as the old one. Solution? Replace them with 4948s, new caveat; no IPv6.. %"#%#" Cisco.</rant>

Edit again; yes they are great switches, just beware of the caveats. I am actually running some 800Mbit/s of WCCP traffic through one of mine. No problem ;)

ior fucked around with this message at 23:37 on Aug 18, 2010

Adbot
ADBOT LOVES YOU

ior
Nov 21, 2003

What's a fuckass?

Jimmy Carter posted:

Welp.
I’m trying to get my router working with my cable modem. I just want to start super-simple, and get all the devices in my house IPs, on the internet, and go from there. What I’ve got so far is a combination of CCNA manuals, tutorials, and the default config (I refuse to use SDM)

Your config is missing the following;
ip nat inside source list 1 interface FastEthernet4 overload

Also the thing about mac-addresses. Try cloning your last used device.

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply